/usr/src/sys/dev/ic/ncr53c9x.c

Bug Summary

File:	dev/ic/ncr53c9x.c
Warning:	line 2145, column 4 Access to field 'xs' results in a dereference of a null pointer (loaded from variable 'ecb')
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name ncr53c9x.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model static -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -ffreestanding -mcmodel=kernel -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -target-feature -sse2 -target-feature -sse -target-feature -3dnow -target-feature -mmx -target-feature +save-args -target-feature +retpoline-external-thunk -disable-red-zone -no-implicit-float -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -nostdsysteminc -nobuiltininc -resource-dir /usr/local/llvm16/lib/clang/16 -I /usr/src/sys -I /usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -I /usr/src/sys/arch -I /usr/src/sys/dev/pci/drm/include -I /usr/src/sys/dev/pci/drm/include/uapi -I /usr/src/sys/dev/pci/drm/amd/include/asic_reg -I /usr/src/sys/dev/pci/drm/amd/include -I /usr/src/sys/dev/pci/drm/amd/amdgpu -I /usr/src/sys/dev/pci/drm/amd/display -I /usr/src/sys/dev/pci/drm/amd/display/include -I /usr/src/sys/dev/pci/drm/amd/display/dc -I /usr/src/sys/dev/pci/drm/amd/display/amdgpu_dm -I /usr/src/sys/dev/pci/drm/amd/pm/inc -I /usr/src/sys/dev/pci/drm/amd/pm/legacy-dpm -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu11 -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu12 -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu13 -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/inc -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/hwmgr -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/smumgr -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc/pmfw_if -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc/hw -I /usr/src/sys/dev/pci/drm/amd/display/dc/clk_mgr -I /usr/src/sys/dev/pci/drm/amd/display/modules/inc -I /usr/src/sys/dev/pci/drm/amd/display/modules/hdcp -I /usr/src/sys/dev/pci/drm/amd/display/dmub/inc -I /usr/src/sys/dev/pci/drm/i915 -D DDB -D DIAGNOSTIC -D KTRACE -D ACCOUNTING -D KMEMSTATS -D PTRACE -D POOL_DEBUG -D CRYPTO -D SYSVMSG -D SYSVSEM -D SYSVSHM -D UVM_SWAP_ENCRYPT -D FFS -D FFS2 -D FFS_SOFTUPDATES -D UFS_DIRHASH -D QUOTA -D EXT2FS -D MFS -D NFSCLIENT -D NFSSERVER -D CD9660 -D UDF -D MSDOSFS -D FIFO -D FUSE -D SOCKET_SPLICE -D TCP_ECN -D TCP_SIGNATURE -D INET6 -D IPSEC -D PPP_BSDCOMP -D PPP_DEFLATE -D PIPEX -D MROUTING -D MPLS -D BOOT_CONFIG -D USER_PCICONF -D APERTURE -D MTRR -D NTFS -D SUSPEND -D HIBERNATE -D PCIVERBOSE -D USBVERBOSE -D WSDISPLAY_COMPAT_USL -D WSDISPLAY_COMPAT_RAWKBD -D WSDISPLAY_DEFAULTSCREENS=6 -D X86EMU -D ONEWIREVERBOSE -D MULTIPROCESSOR -D MAXUSERS=80 -D _KERNEL -O2 -Wno-pointer-sign -Wno-address-of-packed-member -Wno-constant-conversion -Wno-unused-but-set-variable -Wno-gnu-folding-constant -fdebug-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -o /home/ben/Projects/scan/2024-01-11-110808-61670-1 -x c /usr/src/sys/dev/ic/ncr53c9x.c
1/*	$OpenBSD: ncr53c9x.c,v 1.80 2022/04/16 19:19:59 naddy Exp $	*/
2/*     $NetBSD: ncr53c9x.c,v 1.56 2000/11/30 14:41:46 thorpej Exp $    */

4/*
* Copyright (c) 1996 Charles M. Hannum.  All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
* 3. All advertising materials mentioning features or use of this software
*    must display the following acknowledgement:
*	This product includes software developed by Charles M. Hannum.
* 4. The name of the author may not be used to endorse or promote products
*    derived from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/

33/*
* Copyright (c) 1994 Peter Galbavy
* Copyright (c) 1995 Paul Kranenburg
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
* INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
* ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/

60/*
* Based on aic6360 by Jarle Greipsland
*
* Acknowledgements: Many of the algorithms used in this driver are
* inspired by the work of Julian Elischer (julian@tfs.com) and
* Charles Hannum (mycroft@duality.gnu.ai.mit.edu).  Thanks a million!
*/

68#include <sys/param.h>
69#include <sys/systm.h>
70#include <sys/kernel.h>
71#include <sys/errno.h>
72#include <sys/ioctl.h>
73#include <sys/device.h>
74#include <sys/malloc.h>
75#include <sys/queue.h>
76#include <sys/pool.h>

78#include <scsi/scsi_all.h>
79#include <scsi/scsiconf.h>
80#include <scsi/scsi_message.h>

82#include <machine/cpu.h>

84#include <dev/ic/ncr53c9xreg.h>
85#include <dev/ic/ncr53c9xvar.h>

87#ifdef NCR53C9X_DEBUG1
88int ncr53c9x_debug = 0; /*NCR_SHOWPHASE|NCR_SHOWMISC|NCR_SHOWTRAC|NCR_SHOWCMDS;*/
89#endif
90#ifdef DEBUG
91int ncr53c9x_notag = 0;
92#endif

94/*static*/ void	ncr53c9x_readregs(struct ncr53c9x_softc *);
95/*static*/ void	ncr53c9x_select(struct ncr53c9x_softc *,
			    struct ncr53c9x_ecb *);
97/*static*/ int ncr53c9x_reselect(struct ncr53c9x_softc *, int, int, int);
98/*static*/ void	ncr53c9x_scsi_reset(struct ncr53c9x_softc *);
99/*static*/ int	ncr53c9x_poll(struct ncr53c9x_softc *,
			    struct scsi_xfer *, int);
101/*static*/ void	ncr53c9x_sched(struct ncr53c9x_softc *);
102/*static*/ void	ncr53c9x_done(struct ncr53c9x_softc *,
			    struct ncr53c9x_ecb *);
104/*static*/ void	ncr53c9x_msgin(struct ncr53c9x_softc *);
105/*static*/ void	ncr53c9x_msgout(struct ncr53c9x_softc *);
106/*static*/ void	ncr53c9x_timeout(void *arg);
107/*static*/ void	ncr53c9x_abort(struct ncr53c9x_softc *,
			    struct ncr53c9x_ecb *);
109/*static*/ void ncr53c9x_dequeue(struct ncr53c9x_softc *,
			    struct ncr53c9x_ecb *);

112void ncr53c9x_sense(struct ncr53c9x_softc *,
			    struct ncr53c9x_ecb *);
114void ncr53c9x_free_ecb(void *, void *);
115void *ncr53c9x_get_ecb(void *);

117static inline int ncr53c9x_stp2cpb(struct ncr53c9x_softc *, int);
118static inline void ncr53c9x_setsync(struct ncr53c9x_softc *,
			    struct ncr53c9x_tinfo *);
120static struct ncr53c9x_linfo *ncr53c9x_lunsearch(struct ncr53c9x_tinfo *,
  int64_t lun);

123static void ncr53c9x_wrfifo(struct ncr53c9x_softc *, u_char *, int);
124static int ncr53c9x_rdfifo(struct ncr53c9x_softc *, int);
125#define NCR_RDFIFO_START0	0
126#define NCR_RDFIFO_CONTINUE1	1

128#define NCR_SET_COUNT(sc, size)do { (*((sc))->sc_glue->gl_write_reg)(((sc)), (0x00), (
(size))); (*((sc))->sc_glue->gl_write_reg)(((sc)), (0x01
), ((size) >> 8)); if ((sc->sc_cfg2 & 0x40) || (
sc->sc_rev == 9)) { (*((sc))->sc_glue->gl_write_reg)
(((sc)), (0x0e), ((size) >> 16)); } if (sc->sc_rev ==
 9) { (*(sc)->sc_glue->gl_write_reg)((sc), (0xf), (0));
 } } while (0) do {						\
	NCR_WRITE_REG((sc), NCR_TCL, (size))(*((sc))->sc_glue->gl_write_reg)(((sc)), (0x00), ((size
)));			\
	NCR_WRITE_REG((sc), NCR_TCM, (size) >> 8)(*((sc))->sc_glue->gl_write_reg)(((sc)), (0x01), ((size
) >> 8));		\
	if ((sc->sc_cfg2 & NCRCFG2_FE0x40) ||			\
	    (sc->sc_rev == NCR_VARIANT_FAS3669)) {		\
		NCR_WRITE_REG((sc), NCR_TCH, (size) >> 16)(*((sc))->sc_glue->gl_write_reg)(((sc)), (0x0e), ((size
) >> 16));	\
	}							\
	if (sc->sc_rev == NCR_VARIANT_FAS3669) {			\
		NCR_WRITE_REG(sc, NCR_RCH, 0)(*(sc)->sc_glue->gl_write_reg)((sc), (0xf), (0));			\
	}							\
138} while (0)

140static int ecb_pool_initialized = 0;
141static struct scsi_iopool ecb_iopool;
142static struct pool ecb_pool;

144struct cfdriver esp_cd = {
NULL((void *)0), "esp", DV_DULL
146};

148void	ncr53c9x_scsi_cmd(struct scsi_xfer *);
149int	ncr53c9x_scsi_probe(struct scsi_link *);
150void	ncr53c9x_scsi_free(struct scsi_link *);

152const struct scsi_adapter ncr53c9x_switch = {
ncr53c9x_scsi_cmd, NULL((void *)0), ncr53c9x_scsi_probe,
ncr53c9x_scsi_free, NULL((void *)0)
155};

157/*
* Names for the NCR53c9x variants, corresponding to the variant tags
* in ncr53c9xvar.h.
*/
161const char *ncr53c9x_variant_names[] = {
"ESP100",
"ESP100A",
"ESP200",
"NCR53C94",
"NCR53C96",
"ESP406",
"FAS408",
"FAS216",
"AM53C974",
"FAS366/HME",
172};

174/*
* Search linked list for LUN info by LUN id.
*/
177static struct ncr53c9x_linfo *
178ncr53c9x_lunsearch(struct ncr53c9x_tinfo *ti, int64_t lun)
179{
struct ncr53c9x_linfo *li;
LIST_FOREACH(li, &ti->luns, link)for((li) = ((&ti->luns)->lh_first); (li)!= ((void *
)0); (li) = ((li)->link.le_next))
   if (li->lun == lun)
    return (li);
return (NULL((void *)0));
185}

187/*
* Attach this instance, and then all the sub-devices
*/
190void
191ncr53c9x_attach(struct ncr53c9x_softc *sc)
192{
struct scsibus_attach_args saa;

/*
* Allocate SCSI message buffers.
* Front-ends can override allocation to avoid alignment
* handling in the DMA engines. Note that ncr53c9x_msgout()
* can request a 1 byte DMA transfer.
*/
if (sc->sc_omess == NULL((void *)0))
sc->sc_omess = malloc(NCR_MAX_MSG_LEN8, M_DEVBUF2, M_NOWAIT0x0002);

if (sc->sc_imess == NULL((void *)0))
sc->sc_imess = malloc(NCR_MAX_MSG_LEN8+1, M_DEVBUF2, M_NOWAIT0x0002);

if (sc->sc_omess == NULL((void *)0) || sc->sc_imess == NULL((void *)0)) {
printf("out of memory\n");
return;
}

/*
* Note, the front-end has set us up to print the chip variation.
*/
if (sc->sc_rev >= NCR_VARIANT_MAX10) {
printf("\n%s: unknown variant %d, devices not attached\n",
    sc->sc_dev.dv_xname, sc->sc_rev);
return;
}

printf(": %s, %dMHz\n", ncr53c9x_variant_names[sc->sc_rev],
   sc->sc_freq);

sc->sc_ccf = FREQTOCCF(sc->sc_freq)(((sc->sc_freq + 4) / 5));

/* The value *must not* be == 1. Make it 2 */
if (sc->sc_ccf == 1)
sc->sc_ccf = 2;

/*
* The recommended timeout is 250ms. This register is loaded
* with a value calculated as follows, from the docs:
*
*		(timeout period) x (CLK frequency)
*	reg = -------------------------------------
*		 8192 x (Clock Conversion Factor)
*
* Since CCF has a linear relation to CLK, this generally computes
* to the constant of 153.
*/
sc->sc_timeout = ((250 * 1000) * sc->sc_freq) / (8192 * sc->sc_ccf);

/* CCF register only has 3 bits; 0 is actually 8 */
sc->sc_ccf &= 7;

/* Find how many targets we need to support */
switch (sc->sc_rev) {
case NCR_VARIANT_FAS3669:
sc->sc_ntarg = 16;
break;
default:
sc->sc_ntarg = 8;
break;
}

/* Reset state & bus */
sc->sc_cfflags = sc->sc_dev.dv_cfdata->cf_flags;
sc->sc_state = 0;
ncr53c9x_init(sc, 1);

saa.saa_adapter_softc = sc;
saa.saa_adapter_target = sc->sc_id;
saa.saa_adapter = &ncr53c9x_switch;
saa.saa_adapter_buswidth = sc->sc_ntarg;
saa.saa_luns = 8;
saa.saa_openings = 2;
saa.saa_pool = &ecb_iopool;
saa.saa_quirks = saa.saa_flags = 0;
saa.saa_wwpn = saa.saa_wwnn = 0;

config_found(&sc->sc_dev, &saa, scsiprint)config_found_sm((&sc->sc_dev), (&saa), (scsiprint)
, ((void *)0));
272}

274/*
* This is the generic ncr53c9x reset function. It does not reset the SCSI bus,
* only this controller, but kills any on-going commands, and also stops
* and resets the DMA.
*
* After reset, registers are loaded with the defaults from the attach
* routine above.
*/
282void
283ncr53c9x_reset(struct ncr53c9x_softc *sc)
284{

/* reset DMA first */
NCRDMA_RESET(sc)(*(sc)->sc_glue->gl_dma_reset)((sc));

/* reset SCSI chip */
NCRCMD(sc, NCRCMD_RSTCHIP)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x02, 290); sc->sc_lastcmd = 0x02; (*(sc)->
sc_glue->gl_write_reg)((sc), (0x03), (0x02)); } while (0);
NCRCMD(sc, NCRCMD_NOP)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x00, 291); sc->sc_lastcmd = 0x00; (*(sc)->
sc_glue->gl_write_reg)((sc), (0x03), (0x00)); } while (0);
DELAY(500)(*delay_func)(500);

/* do these backwards, and fall through */
switch (sc->sc_rev) {
case NCR_VARIANT_ESP4065:
case NCR_VARIANT_FAS4086:
NCR_WRITE_REG(sc, NCR_CFG5, sc->sc_cfg5 | NCRCFG5_SINT)(*(sc)->sc_glue->gl_write_reg)((sc), (0x0d), (sc->sc_cfg5
 | 0x04));
NCR_WRITE_REG(sc, NCR_CFG4, sc->sc_cfg4)(*(sc)->sc_glue->gl_write_reg)((sc), (0x0d), (sc->sc_cfg4
));
case NCR_VARIANT_AM53C9748:
case NCR_VARIANT_FAS2167:
case NCR_VARIANT_NCR53C943:
case NCR_VARIANT_NCR53C964:
case NCR_VARIANT_ESP2002:
sc->sc_features |= NCR_F_HASCFG30x01;
NCR_WRITE_REG(sc, NCR_CFG3, sc->sc_cfg3)(*(sc)->sc_glue->gl_write_reg)((sc), (0x0c), (sc->sc_cfg3
));
case NCR_VARIANT_ESP100A1:
sc->sc_features |= NCR_F_SELATN30x08;
NCR_WRITE_REG(sc, NCR_CFG2, sc->sc_cfg2)(*(sc)->sc_glue->gl_write_reg)((sc), (0x0b), (sc->sc_cfg2
));
case NCR_VARIANT_ESP1000:
NCR_WRITE_REG(sc, NCR_CFG1, sc->sc_cfg1)(*(sc)->sc_glue->gl_write_reg)((sc), (0x08), (sc->sc_cfg1
));
NCR_WRITE_REG(sc, NCR_CCF, sc->sc_ccf)(*(sc)->sc_glue->gl_write_reg)((sc), (0x09), (sc->sc_ccf
));
NCR_WRITE_REG(sc, NCR_SYNCOFF, 0)(*(sc)->sc_glue->gl_write_reg)((sc), (0x07), (0));
NCR_WRITE_REG(sc, NCR_TIMEOUT, sc->sc_timeout)(*(sc)->sc_glue->gl_write_reg)((sc), (0x05), (sc->sc_timeout
));
break;
case NCR_VARIANT_FAS3669:
sc->sc_features |=
    NCR_F_SELATN30x08 | NCR_F_HASCFG30x01 | NCR_F_FASTSCSI0x02;
sc->sc_cfg3 = NCRFASCFG3_FASTCLK0x01 | NCRFASCFG3_OBAUTO0x80;
sc->sc_cfg3_fscsi = NCRFASCFG3_FASTSCSI0x02;
NCR_WRITE_REG(sc, NCR_CFG3, sc->sc_cfg3)(*(sc)->sc_glue->gl_write_reg)((sc), (0x0c), (sc->sc_cfg3
));
sc->sc_cfg2 = 0; /* NCRCFG2_HMEFE | NCRCFG2_HME32 */
NCR_WRITE_REG(sc, NCR_CFG2, sc->sc_cfg2)(*(sc)->sc_glue->gl_write_reg)((sc), (0x0b), (sc->sc_cfg2
));
NCR_WRITE_REG(sc, NCR_CFG1, sc->sc_cfg1)(*(sc)->sc_glue->gl_write_reg)((sc), (0x08), (sc->sc_cfg1
));
NCR_WRITE_REG(sc, NCR_CCF, sc->sc_ccf)(*(sc)->sc_glue->gl_write_reg)((sc), (0x09), (sc->sc_ccf
));
NCR_WRITE_REG(sc, NCR_SYNCOFF, 0)(*(sc)->sc_glue->gl_write_reg)((sc), (0x07), (0));
NCR_WRITE_REG(sc, NCR_TIMEOUT, sc->sc_timeout)(*(sc)->sc_glue->gl_write_reg)((sc), (0x05), (sc->sc_timeout
));
break;
default:
printf("%s: unknown revision code, assuming ESP100\n",
    sc->sc_dev.dv_xname);
NCR_WRITE_REG(sc, NCR_CFG1, sc->sc_cfg1)(*(sc)->sc_glue->gl_write_reg)((sc), (0x08), (sc->sc_cfg1
));
NCR_WRITE_REG(sc, NCR_CCF, sc->sc_ccf)(*(sc)->sc_glue->gl_write_reg)((sc), (0x09), (sc->sc_ccf
));
NCR_WRITE_REG(sc, NCR_SYNCOFF, 0)(*(sc)->sc_glue->gl_write_reg)((sc), (0x07), (0));
NCR_WRITE_REG(sc, NCR_TIMEOUT, sc->sc_timeout)(*(sc)->sc_glue->gl_write_reg)((sc), (0x05), (sc->sc_timeout
));
}

if (sc->sc_rev == NCR_VARIANT_AM53C9748)
NCR_WRITE_REG(sc, NCR_AMDCFG4, sc->sc_cfg4)(*(sc)->sc_glue->gl_write_reg)((sc), (0x0d), (sc->sc_cfg4
));

341#if 0
printf("%s: ncr53c9x_reset: revision %d\n",
   sc->sc_dev.dv_xname, sc->sc_rev);
printf("%s: ncr53c9x_reset: cfg1 0x%x, cfg2 0x%x, cfg3 0x%x, ccf 0x%x, timeout 0x%x\n",
   sc->sc_dev.dv_xname,
   sc->sc_cfg1, sc->sc_cfg2, sc->sc_cfg3,
   sc->sc_ccf, sc->sc_timeout);
348#endif
349}

351/*
* Reset the SCSI bus, but not the chip
*/
354void
355ncr53c9x_scsi_reset(struct ncr53c9x_softc *sc)
356{

(*sc->sc_glue->gl_dma_stop)(sc);

printf("%s: resetting SCSI bus\n", sc->sc_dev.dv_xname);
NCRCMD(sc, NCRCMD_RSTSCSI)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x03, 361); sc->sc_lastcmd = 0x03; (*(sc)->
sc_glue->gl_write_reg)((sc), (0x03), (0x03)); } while (0);
362}

364/*
* Initialize ncr53c9x state machine
*/
367void
368ncr53c9x_init(struct ncr53c9x_softc *sc, int doreset)
369{
struct ncr53c9x_ecb *ecb;
struct ncr53c9x_linfo *li;
int r, i;

NCR_TRACE(("[NCR_INIT(%d) %d] ", doreset, sc->sc_state))do {if (ncr53c9x_debug & 0x10) printf ("[NCR_INIT(%d) %d] "
, doreset, sc->sc_state);} while (0);

if (!ecb_pool_initialized) {
/* All instances share this pool */
pool_init(&ecb_pool, sizeof(struct ncr53c9x_ecb), 0, IPL_BIO0x3,
    0, "ncr53c9x_ecb", NULL((void *)0));
scsi_iopool_init(&ecb_iopool, NULL((void *)0),
    ncr53c9x_get_ecb, ncr53c9x_free_ecb);
ecb_pool_initialized = 1;
}

if (sc->sc_state == 0) {
/* First time through; initialize. */

TAILQ_INIT(&sc->ready_list)do { (&sc->ready_list)->tqh_first = ((void *)0); (&
sc->ready_list)->tqh_last = &(&sc->ready_list
)->tqh_first; } while (0);
sc->sc_nexus = NULL((void *)0);
bzero(sc->sc_tinfo, sizeof(sc->sc_tinfo))__builtin_bzero((sc->sc_tinfo), (sizeof(sc->sc_tinfo)));
for (r = 0; r < sc->sc_ntarg; r++) {
	LIST_INIT(&sc->sc_tinfo[r].luns)do { ((&sc->sc_tinfo[r].luns)->lh_first) = ((void *
)0); } while (0);
}
} else {
/* Cancel any active commands. */
sc->sc_state = NCR_CLEANING8;
sc->sc_msgify = 0;
if ((ecb = sc->sc_nexus) != NULL((void *)0)) {
	ecb->xs->error = XS_TIMEOUT4;
	ncr53c9x_done(sc, ecb);
}
for (r = 0; r < sc->sc_ntarg; r++) {
	LIST_FOREACH(li, &sc->sc_tinfo[r].luns, link)for((li) = ((&sc->sc_tinfo[r].luns)->lh_first); (li
)!= ((void *)0); (li) = ((li)->link.le_next)) {
		if ((ecb = li->untagged)) {
			li->untagged = NULL((void *)0);
			/*
			 * XXXXXXX
			 * Should we terminate a command
			 * that never reached the disk?
			 */
			li->busy = 0;
			ecb->xs->error = XS_TIMEOUT4;
			ncr53c9x_done(sc, ecb);
		}
		for (i = 0; i < 256; i++)
			if ((ecb = li->queued[i])) {
				li->queued[i] = NULL((void *)0);
				ecb->xs->error = XS_TIMEOUT4;
				ncr53c9x_done(sc, ecb);
			}
		li->used = 0;
	}
}
}

/*
* reset the chip to a known state
*/
ncr53c9x_reset(sc);

sc->sc_phase = sc->sc_prevphase = INVALID_PHASE0x101;
for (r = 0; r < sc->sc_ntarg; r++) {
struct ncr53c9x_tinfo *ti = &sc->sc_tinfo[r];
434/* XXX - config flags per target: low bits: no reselect; high bits: no synch */

              ti->flags = ((!(sc->sc_cfflags & (1 << (r + 16))) &&
    sc->sc_minsync) ? 0 : T_SYNCHOFF0x10) |
    ((sc->sc_cfflags & (1 << r)) ?  T_RSELECTOFF0x20 : 0) |
    T_NEED_TO_RESET0x01;
440#ifdef DEBUG
 if (ncr53c9x_notag)
	 ti->flags &= ~T_TAG0x40;
443#endif
ti->period = sc->sc_minsync;
ti->offset = 0;
ti->cfg3 = 0;
}

if (doreset) {
sc->sc_state = NCR_SBR9;
NCRCMD(sc, NCRCMD_RSTSCSI)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x03, 451); sc->sc_lastcmd = 0x03; (*(sc)->
sc_glue->gl_write_reg)((sc), (0x03), (0x03)); } while (0);
/*
 * XXX gross...
 * On some systems, commands issued too close to a reset
 * do not work correctly. We'll force a short delay on
 * known-to-be-sensitive chips.
 */
switch (sc->sc_rev) {
case NCR_VARIANT_NCR53C943:
	DELAY(600000)(*delay_func)(600000);	/* 600ms */
	break;
case NCR_VARIANT_NCR53C964:
	DELAY(100000)(*delay_func)(100000);	/* 100ms */
	break;
}
} else {
sc->sc_state = NCR_IDLE1;
ncr53c9x_sched(sc);
}
470}

472/*
* Read the NCR registers, and save their contents for later use.
* NCR_STAT, NCR_STEP & NCR_INTR are mostly zeroed out when reading
* NCR_INTR - so make sure it is the last read.
*
* I think that (from reading the docs) most bits in these registers
* only make sense when he DMA CSR has an interrupt showing. Call only
* if an interrupt is pending.
*/
481__inline__ void
482ncr53c9x_readregs(struct ncr53c9x_softc *sc)
483{

sc->sc_espstat = NCR_READ_REG(sc, NCR_STAT)(*(sc)->sc_glue->gl_read_reg)((sc), (0x04));
/* Only the stepo bits are of interest */
sc->sc_espstep = NCR_READ_REG(sc, NCR_STEP)(*(sc)->sc_glue->gl_read_reg)((sc), (0x06)) & NCRSTEP_MASK0x07;

if (sc->sc_rev == NCR_VARIANT_FAS3669)
7
←
Assuming field 'sc_rev' is not equal to NCR_VARIANT_FAS366→
8
←
Taking false branch→
sc->sc_espstat2 = NCR_READ_REG(sc, NCR_STAT2)(*(sc)->sc_glue->gl_read_reg)((sc), (0x09));

sc->sc_espintr = NCR_READ_REG(sc, NCR_INTR)(*(sc)->sc_glue->gl_read_reg)((sc), (0x05));
9
←
Value assigned to field 'sc_nexus'→

if (sc->sc_glue->gl_clear_latched_intr != NULL((void *)0))
10
←
Assuming field 'gl_clear_latched_intr' is equal to NULL→
(*sc->sc_glue->gl_clear_latched_intr)(sc);

/*
* Determine the SCSI bus phase, return either a real SCSI bus phase
* or some pseudo phase we use to detect certain exceptions.
*/

sc->sc_phase = (sc->sc_espintr & NCRINTR_DIS0x20)
11
←
Assuming the condition is true→
12
←
'?' condition is true→
	? /* Disconnected */ BUSFREE_PHASE0x100
	: sc->sc_espstat & NCRSTAT_PHASE0x07;

NCR_MISC(("regs[intr=%02x,stat=%02x,step=%02x,stat2=%02x] ",do {if (ncr53c9x_debug & 0x08) printf ("regs[intr=%02x,stat=%02x,step=%02x,stat2=%02x] "
, sc->sc_espintr, sc->sc_espstat, sc->sc_espstep, sc
->sc_espstat2);} while (0)
13
←
Assuming the condition is false→
14
←
Taking false branch→
15
←
Loop condition is false.  Exiting loop→
sc->sc_espintr, sc->sc_espstat, sc->sc_espstep, sc->sc_espstat2))do {if (ncr53c9x_debug & 0x08) printf ("regs[intr=%02x,stat=%02x,step=%02x,stat2=%02x] "
, sc->sc_espintr, sc->sc_espstat, sc->sc_espstep, sc
->sc_espstat2);} while (0);
508}

510/*
* Convert Synchronous Transfer Period to chip register Clock Per Byte value.
*/
513static inline int
514ncr53c9x_stp2cpb(struct ncr53c9x_softc *sc, int period)
515{
int v;
v = (sc->sc_freq * period) / 250;
if (ncr53c9x_cpb2stp(sc, v)((250 * (v)) / (sc)->sc_freq) < period)
/* Correct round-down error */
v++;
return (v);
522}

524static inline void
525ncr53c9x_setsync(struct ncr53c9x_softc *sc, struct ncr53c9x_tinfo *ti)
526{
u_char syncoff, synctp;
u_char cfg3 = sc->sc_cfg3 | ti->cfg3;

if (ti->flags & T_SYNCMODE0x08) {
syncoff = ti->offset;
synctp = ncr53c9x_stp2cpb(sc, ti->period);
if (sc->sc_features & NCR_F_FASTSCSI0x02) {
	/*
	 * If the period is 200ns or less (ti->period <= 50),
	 * put the chip in Fast SCSI mode.
	 */
	if (ti->period <= 50)
		/*
		 * There are (at least) 4 variations of the
		 * configuration 3 register.  The drive attach
		 * routine sets the appropriate bit to put the
		 * chip into Fast SCSI mode so that it doesn't
		 * have to be figured out here each time.
		 */
		cfg3 |= (sc->sc_rev == NCR_VARIANT_AM53C9748) ?
		    NCRAMDCFG3_FSCSI0x10 : NCRCFG3_FSCSI0x02;
}

/*
 * Am53c974 requires different SYNCTP values when the
 * FSCSI bit is off.
 */
if (sc->sc_rev == NCR_VARIANT_AM53C9748 &&
    (cfg3 & NCRAMDCFG3_FSCSI0x10) == 0)
	synctp--;
} else {
syncoff = 0;
synctp = 0;
}

if (sc->sc_features & NCR_F_HASCFG30x01)
NCR_WRITE_REG(sc, NCR_CFG3, cfg3)(*(sc)->sc_glue->gl_write_reg)((sc), (0x0c), (cfg3));

NCR_WRITE_REG(sc, NCR_SYNCOFF, syncoff)(*(sc)->sc_glue->gl_write_reg)((sc), (0x07), (syncoff));
NCR_WRITE_REG(sc, NCR_SYNCTP, synctp)(*(sc)->sc_glue->gl_write_reg)((sc), (0x06), (synctp));
567}

569/*
* Send a command to a target, set the driver state to NCR_SELECTING
* and let the caller take care of the rest.
*
* Keeping this as a function allows me to say that this may be done
* by DMA instead of programmed I/O soon.
*/
576void
577ncr53c9x_select(struct ncr53c9x_softc *sc, struct ncr53c9x_ecb *ecb)
578{
struct scsi_link *sc_link = ecb->xs->sc_link;
int target = sc_link->target;
int lun = sc_link->lun;
struct ncr53c9x_tinfo *ti = &sc->sc_tinfo[target];
int tiflags = ti->flags;
u_char *cmd;
int clen;
int selatn3, selatns;
size_t dmasize;

NCR_TRACE(("[ncr53c9x_select(t%d,l%d,cmd:%x,tag%x,%x)] ",do {if (ncr53c9x_debug & 0x10) printf ("[ncr53c9x_select(t%d,l%d,cmd:%x,tag%x,%x)] "
, target, lun, ecb->cmd.cmd.opcode, ecb->tag[0], ecb->
tag[1]);} while (0)
   target, lun, ecb->cmd.cmd.opcode, ecb->tag[0], ecb->tag[1]))do {if (ncr53c9x_debug & 0x10) printf ("[ncr53c9x_select(t%d,l%d,cmd:%x,tag%x,%x)] "
, target, lun, ecb->cmd.cmd.opcode, ecb->tag[0], ecb->
tag[1]);} while (0);

sc->sc_state = NCR_SELECTING2;
/*
* Schedule the timeout now, the first time we will go away
* expecting to come back due to an interrupt, because it is
* always possible that the interrupt may never happen.
*/
if ((ecb->xs->flags & SCSI_POLL0x00002) == 0) {
int timeout = ecb->timeout;

if (timeout > 1000000)
	timeout = (timeout / 1000) * hz;
else
	timeout = (timeout * hz) / 1000;
timeout_add(&ecb->to, timeout);
}

/*
* The docs say the target register is never reset, and I
* can't think of a better place to set it
*/
if (sc->sc_rev == NCR_VARIANT_FAS3669) {
NCRCMD(sc, NCRCMD_FLUSH)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x01, 613); sc->sc_lastcmd = 0x01; (*(sc)->
sc_glue->gl_write_reg)((sc), (0x03), (0x01)); } while (0);
NCR_WRITE_REG(sc, NCR_SELID, target | NCR_BUSID_HME)(*(sc)->sc_glue->gl_write_reg)((sc), (0x04), (target | 0x10
));
} else {
NCR_WRITE_REG(sc, NCR_SELID, target)(*(sc)->sc_glue->gl_write_reg)((sc), (0x04), (target));
}
ncr53c9x_setsync(sc, ti);

if ((ecb->flags & ECB_SENSE0x04) != 0) {
/*
 * For REQUEST SENSE, we should not send an IDENTIFY or
 * otherwise mangle the target.  There should be no MESSAGE IN
 * phase.
 */
if (sc->sc_features & NCR_F_DMASELECT0x04) {
	/* setup DMA transfer for command */
	dmasize = clen = ecb->clen;
	sc->sc_cmdlen = clen;
	sc->sc_cmdp = (caddr_t)&ecb->cmd.cmd;

	NCRDMA_SETUP(sc, &sc->sc_cmdp, &sc->sc_cmdlen, 0,(*(sc)->sc_glue->gl_dma_setup)((sc), (&sc->sc_cmdp
), (&sc->sc_cmdlen), (0), (&dmasize))
	    &dmasize)(*(sc)->sc_glue->gl_dma_setup)((sc), (&sc->sc_cmdp
), (&sc->sc_cmdlen), (0), (&dmasize));
	/* Program the SCSI counter */
	NCR_SET_COUNT(sc, dmasize)do { (*((sc))->sc_glue->gl_write_reg)(((sc)), (0x00), (
(dmasize))); (*((sc))->sc_glue->gl_write_reg)(((sc)), (
0x01), ((dmasize) >> 8)); if ((sc->sc_cfg2 & 0x40
) || (sc->sc_rev == 9)) { (*((sc))->sc_glue->gl_write_reg
)(((sc)), (0x0e), ((dmasize) >> 16)); } if (sc->sc_rev
 == 9) { (*(sc)->sc_glue->gl_write_reg)((sc), (0xf), (0
)); } } while (0);

	if (sc->sc_rev != NCR_VARIANT_FAS3669)
		NCRCMD(sc, NCRCMD_NOP|NCRCMD_DMA)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x00|0x80, 638); sc->sc_lastcmd = 0x00|0x80; (
*(sc)->sc_glue->gl_write_reg)((sc), (0x03), (0x00|0x80)
); } while (0);

	/* And get the targets attention */
	NCRCMD(sc, NCRCMD_SELNATN | NCRCMD_DMA)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x41 | 0x80, 641); sc->sc_lastcmd = 0x41 | 0x80
; (*(sc)->sc_glue->gl_write_reg)((sc), (0x03), (0x41 | 0x80
)); } while (0);
	NCRDMA_GO(sc)(*(sc)->sc_glue->gl_dma_go)((sc));
} else {
	ncr53c9x_wrfifo(sc, (u_char *)&ecb->cmd.cmd, ecb->clen);
	sc->sc_cmdlen = 0;
	NCRCMD(sc, NCRCMD_SELNATN)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x41, 646); sc->sc_lastcmd = 0x41; (*(sc)->
sc_glue->gl_write_reg)((sc), (0x03), (0x41)); } while (0);
}
return;
}

selatn3 = selatns = 0;
if (ecb->tag[0] != 0) {
if (sc->sc_features & NCR_F_SELATN30x08)
	/* use SELATN3 to send tag messages */
	selatn3 = 1;
else
	/* We don't have SELATN3; use SELATNS to send tags */
	selatns = 1;
}

if (ti->flags & T_NEGOTIATE0x02) {
/* We have to use SELATNS to send sync/wide messages */
selatn3 = 0;
selatns = 1;
}

cmd = (u_char *)&ecb->cmd.cmd;

if (selatn3) {
/* We'll use tags with SELATN3 */
clen = ecb->clen + 3;
cmd -= 3;
cmd[0] = MSG_IDENTIFY(lun, 1)(((1) ? 0xc0 : 0x80) | (lun));	/* msg[0] */
cmd[1] = ecb->tag[0];		/* msg[1] */
cmd[2] = ecb->tag[1];		/* msg[2] */
} else {
/* We don't have tags, or will send messages with SELATNS */
clen = ecb->clen + 1;
cmd -= 1;
cmd[0] = MSG_IDENTIFY(lun, (tiflags & T_RSELECTOFF) == 0)((((tiflags & 0x20) == 0) ? 0xc0 : 0x80) | (lun));
}

if ((sc->sc_features & NCR_F_DMASELECT0x04) && !selatns) {

/* setup DMA transfer for command */
dmasize = clen;
sc->sc_cmdlen = clen;
sc->sc_cmdp = cmd;

NCRDMA_SETUP(sc, &sc->sc_cmdp, &sc->sc_cmdlen, 0, &dmasize)(*(sc)->sc_glue->gl_dma_setup)((sc), (&sc->sc_cmdp
), (&sc->sc_cmdlen), (0), (&dmasize));
/* Program the SCSI counter */
NCR_SET_COUNT(sc, dmasize)do { (*((sc))->sc_glue->gl_write_reg)(((sc)), (0x00), (
(dmasize))); (*((sc))->sc_glue->gl_write_reg)(((sc)), (
0x01), ((dmasize) >> 8)); if ((sc->sc_cfg2 & 0x40
) || (sc->sc_rev == 9)) { (*((sc))->sc_glue->gl_write_reg
)(((sc)), (0x0e), ((dmasize) >> 16)); } if (sc->sc_rev
 == 9) { (*(sc)->sc_glue->gl_write_reg)((sc), (0xf), (0
)); } } while (0);

/* load the count in */
/* if (sc->sc_rev != NCR_VARIANT_FAS366) */
	NCRCMD(sc, NCRCMD_NOP|NCRCMD_DMA)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x00|0x80, 696); sc->sc_lastcmd = 0x00|0x80; (
*(sc)->sc_glue->gl_write_reg)((sc), (0x03), (0x00|0x80)
); } while (0);

/* And get the targets attention */
if (selatn3) {
	sc->sc_msgout = SEND_TAG0x0100;
	sc->sc_flags |= NCR_ATN0x40;
	NCRCMD(sc, NCRCMD_SELATN3 | NCRCMD_DMA)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x46 | 0x80, 702); sc->sc_lastcmd = 0x46 | 0x80
; (*(sc)->sc_glue->gl_write_reg)((sc), (0x03), (0x46 | 0x80
)); } while (0);
} else
	NCRCMD(sc, NCRCMD_SELATN | NCRCMD_DMA)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x42 | 0x80, 704); sc->sc_lastcmd = 0x42 | 0x80
; (*(sc)->sc_glue->gl_write_reg)((sc), (0x03), (0x42 | 0x80
)); } while (0);
NCRDMA_GO(sc)(*(sc)->sc_glue->gl_dma_go)((sc));
return;
}

/*
* Who am I. This is where we tell the target that we are
* happy for it to disconnect etc.
*/

/* Now get the command into the FIFO */
sc->sc_cmdlen = 0;
ncr53c9x_wrfifo(sc, cmd, clen);

/* And get the targets attention */
if (selatns) {
NCR_MISC(("SELATNS \n"))do {if (ncr53c9x_debug & 0x08) printf ("SELATNS \n");} while
 (0);
/* Arbitrate, select and stop after IDENTIFY message */
NCRCMD(sc, NCRCMD_SELATNS)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x43, 722); sc->sc_lastcmd = 0x43; (*(sc)->
sc_glue->gl_write_reg)((sc), (0x03), (0x43)); } while (0);
} else if (selatn3) {
sc->sc_msgout = SEND_TAG0x0100;
sc->sc_flags |= NCR_ATN0x40;
NCRCMD(sc, NCRCMD_SELATN3)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x46, 726); sc->sc_lastcmd = 0x46; (*(sc)->
sc_glue->gl_write_reg)((sc), (0x03), (0x46)); } while (0);
} else
NCRCMD(sc, NCRCMD_SELATN)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x42, 728); sc->sc_lastcmd = 0x42; (*(sc)->
sc_glue->gl_write_reg)((sc), (0x03), (0x42)); } while (0);
729}

731/*
* DRIVER FUNCTIONS CALLABLE FROM HIGHER LEVEL DRIVERS
*/

735void *
736ncr53c9x_get_ecb(void *null)
737{
struct ncr53c9x_ecb *ecb;

ecb = pool_get(&ecb_pool, M_NOWAIT0x0002|M_ZERO0x0008);
if (ecb == NULL((void *)0))
return (NULL((void *)0));

timeout_set(&ecb->to, ncr53c9x_timeout, ecb);
ecb->flags |= ECB_ALLOC0x01;

return (ecb);
748}

750void
751ncr53c9x_free_ecb(void *null, void *ecb)
752{
pool_put(&ecb_pool, ecb);
754}

756int
757ncr53c9x_scsi_probe(struct scsi_link *sc_link)
758{
struct ncr53c9x_softc *sc = sc_link->bus->sb_adapter_softc;
struct ncr53c9x_tinfo *ti = &sc->sc_tinfo[sc_link->target];
struct ncr53c9x_linfo *li;
int64_t lun = sc_link->lun;
int s;

/* Initialize LUN info and add to list. */
li = malloc(sizeof(*li), M_DEVBUF2, M_WAITOK0x0001 | M_ZERO0x0008);
if (li == NULL((void *)0))
return (ENOMEM12);

li->last_used = getuptime();
li->lun = lun;

s = splbio()splraise(0x3);
LIST_INSERT_HEAD(&ti->luns, li, link)do { if (((li)->link.le_next = (&ti->luns)->lh_first
) != ((void *)0)) (&ti->luns)->lh_first->link.le_prev
 = &(li)->link.le_next; (&ti->luns)->lh_first
 = (li); (li)->link.le_prev = &(&ti->luns)->
lh_first; } while (0);
if (lun < NCR_NLUN8)
ti->lun[lun] = li;
splx(s)spllower(s);

return (0);

781}

783void
784ncr53c9x_scsi_free(struct scsi_link *sc_link)
785{
struct ncr53c9x_softc *sc = sc_link->bus->sb_adapter_softc;
struct ncr53c9x_tinfo *ti = &sc->sc_tinfo[sc_link->target];
struct ncr53c9x_linfo *li;
int64_t lun = sc_link->lun;
int s;

s = splbio()splraise(0x3);
li = TINFO_LUN(ti, lun)((((lun) < 8) && (((ti)->lun[(lun)]) != ((void *
)0))) ? ((ti)->lun[(lun)]) : ncr53c9x_lunsearch((ti), (int64_t
)(lun)));

LIST_REMOVE(li, link)do { if ((li)->link.le_next != ((void *)0)) (li)->link.
le_next->link.le_prev = (li)->link.le_prev; *(li)->link
.le_prev = (li)->link.le_next; ((li)->link.le_prev) = (
(void *)-1); ((li)->link.le_next) = ((void *)-1); } while (
0);
if (lun < NCR_NLUN8)
ti->lun[lun] = NULL((void *)0);
splx(s)spllower(s);

free(li, M_DEVBUF2, 0);
801}

803/*
* Start a SCSI-command
* This function is called by the higher level SCSI-driver to queue/run
* SCSI-commands.
*/
808void
809ncr53c9x_scsi_cmd(struct scsi_xfer *xs)
810{
struct scsi_link *sc_link = xs->sc_link;
struct ncr53c9x_softc *sc = sc_link->bus->sb_adapter_softc;
struct ncr53c9x_ecb *ecb;
struct ncr53c9x_tinfo *ti;
struct ncr53c9x_linfo *li;
int64_t lun = sc_link->lun;
int s, flags;

NCR_TRACE(("[ncr53c9x_scsi_cmd] "))do {if (ncr53c9x_debug & 0x10) printf ("[ncr53c9x_scsi_cmd] "
);} while (0);
NCR_CMDS(("[0x%x, %d]->%d ", (int)xs->cmd.opcode, xs->cmdlen,do {if (ncr53c9x_debug & 0x04) printf ("[0x%x, %d]->%d "
, (int)xs->cmd.opcode, xs->cmdlen, sc_link->target);
} while (0)
   sc_link->target))do {if (ncr53c9x_debug & 0x04) printf ("[0x%x, %d]->%d "
, (int)xs->cmd.opcode, xs->cmdlen, sc_link->target);
} while (0);

/*
* Commands larger than 12 bytes seem to confuse the chip
* (at least on FAS366 flavours).
*/
if (xs->cmdlen > 12) {
memset(&xs->sense, 0, sizeof(xs->sense))__builtin_memset((&xs->sense), (0), (sizeof(xs->sense
)));
/* sense data borrowed from gdt(4) */
xs->sense.error_code = SSD_ERRCODE_VALID0x80 | SSD_ERRCODE_CURRENT0x70;
xs->sense.flags = SKEY_ILLEGAL_REQUEST0x05;
xs->sense.add_sense_code = 0x20; /* illcmd */
xs->error = XS_SENSE1;
scsi_done(xs);
return;
}

flags = xs->flags;
ti = &sc->sc_tinfo[sc_link->target];
li = TINFO_LUN(ti, lun)((((lun) < 8) && (((ti)->lun[(lun)]) != ((void *
)0))) ? ((ti)->lun[(lun)]) : ncr53c9x_lunsearch((ti), (int64_t
)(lun)));

/* Initialize ecb */
ecb = xs->io;
ecb->xs = xs;
ecb->timeout = xs->timeout;

if (flags & SCSI_RESET0x00200) {
ecb->flags |= ECB_RESET0x80;
ecb->clen = 0;
ecb->dleft = 0;
} else {
bcopy(&xs->cmd, &ecb->cmd.cmd, xs->cmdlen);
ecb->clen = xs->cmdlen;
ecb->daddr = xs->data;
ecb->dleft = xs->datalen;
}
ecb->stat = 0;

s = splbio()splraise(0x3);

TAILQ_INSERT_TAIL(&sc->ready_list, ecb, chain)do { (ecb)->chain.tqe_next = ((void *)0); (ecb)->chain.
tqe_prev = (&sc->ready_list)->tqh_last; *(&sc->
ready_list)->tqh_last = (ecb); (&sc->ready_list)->
tqh_last = &(ecb)->chain.tqe_next; } while (0);
ecb->flags |= ECB_READY0x02;
if (sc->sc_state == NCR_IDLE1)
ncr53c9x_sched(sc);

splx(s)spllower(s);

if ((flags & SCSI_POLL0x00002) == 0)
return;

/* Not allowed to use interrupts, use polling instead */
if (ncr53c9x_poll(sc, xs, ecb->timeout)) {
ncr53c9x_timeout(ecb);
if (ncr53c9x_poll(sc, xs, ecb->timeout))
	ncr53c9x_timeout(ecb);
}
877}

879/*
* Used when interrupt driven I/O isn't allowed, e.g. during boot.
*/
882int
883ncr53c9x_poll(struct ncr53c9x_softc *sc, struct scsi_xfer *xs, int count)
884{
int s;

NCR_TRACE(("[ncr53c9x_poll] "))do {if (ncr53c9x_debug & 0x10) printf ("[ncr53c9x_poll] "
);} while (0);
while (count) {
if (NCRDMA_ISINTR(sc)(*(sc)->sc_glue->gl_dma_isintr)((sc))) {
	s = splbio()splraise(0x3);
	ncr53c9x_intr(sc);
	splx(s)spllower(s);
}
894#if alternatively
if (NCR_READ_REG(sc, NCR_STAT)(*(sc)->sc_glue->gl_read_reg)((sc), (0x04)) & NCRSTAT_INT0x80) {
	s = splbio()splraise(0x3);
	ncr53c9x_intr(sc);
	splx(s)spllower(s);
}
900#endif
if ((xs->flags & ITSDONE0x00008) != 0)
	return (0);
s = splbio()splraise(0x3);
if (sc->sc_state == NCR_IDLE1) {
	NCR_TRACE(("[ncr53c9x_poll: rescheduling] "))do {if (ncr53c9x_debug & 0x10) printf ("[ncr53c9x_poll: rescheduling] "
);} while (0);
	ncr53c9x_sched(sc);
}
splx(s)spllower(s);
DELAY(1000)(*delay_func)(1000);
count--;
}
return (1);
913}


916/*
* LOW LEVEL SCSI UTILITIES
*/

920/*
* Schedule a scsi operation.  This has now been pulled out of the interrupt
* handler so that we may call it from ncr53c9x_scsi_cmd and ncr53c9x_done.
* This may save us an unnecessary interrupt just to get things going.
* Should only be called when state == NCR_IDLE and at bio pl.
*/
926void
927ncr53c9x_sched(struct ncr53c9x_softc *sc)
928{
struct ncr53c9x_ecb *ecb;
struct scsi_link *sc_link;
struct ncr53c9x_tinfo *ti;
int lun;
struct ncr53c9x_linfo *li;
int s, tag;

NCR_TRACE(("[ncr53c9x_sched] "))do {if (ncr53c9x_debug & 0x10) printf ("[ncr53c9x_sched] "
);} while (0);
if (sc->sc_state != NCR_IDLE1)
panic("ncr53c9x_sched: not IDLE (state=%d)", sc->sc_state);

/*
* Find first ecb in ready queue that is for a target/lunit
* combinations that is not busy.
*/
TAILQ_FOREACH(ecb, &sc->ready_list, chain)for((ecb) = ((&sc->ready_list)->tqh_first); (ecb) !=
 ((void *)0); (ecb) = ((ecb)->chain.tqe_next)) {
sc_link = ecb->xs->sc_link;
ti = &sc->sc_tinfo[sc_link->target];
lun = sc_link->lun;

/* Select type of tag for this command */
if ((ti->flags & (T_RSELECTOFF0x20)) != 0)
	tag = 0;
else if ((ti->flags & T_TAG0x40) == 0)
	tag = 0;
else if ((ecb->flags & ECB_SENSE0x04) != 0)
	tag = 0;
else
	tag = MSG_SIMPLE_Q_TAG0x20;
958#if 0
/* XXXX Use tags for polled commands? */
if (ecb->xs->flags & SCSI_POLL0x00002)
	tag = 0;
962#endif
s = splbio()splraise(0x3);
li = TINFO_LUN(ti, lun)((((lun) < 8) && (((ti)->lun[(lun)]) != ((void *
)0))) ? ((ti)->lun[(lun)]) : ncr53c9x_lunsearch((ti), (int64_t
)(lun)));
if (!li) {
	/* Initialize LUN info and add to list. */
	if ((li = malloc(sizeof(*li), M_DEVBUF2,
	    M_NOWAIT0x0002 | M_ZERO0x0008)) == NULL((void *)0)) {
		splx(s)spllower(s);
		continue;
	}
	li->lun = lun;

	LIST_INSERT_HEAD(&ti->luns, li, link)do { if (((li)->link.le_next = (&ti->luns)->lh_first
) != ((void *)0)) (&ti->luns)->lh_first->link.le_prev
 = &(li)->link.le_next; (&ti->luns)->lh_first
 = (li); (li)->link.le_prev = &(&ti->luns)->
lh_first; } while (0);
	if (lun < NCR_NLUN8)
		ti->lun[lun] = li;
}
li->last_used = getuptime();
if (!tag) {
	/* Try to issue this as an un-tagged command */
	if (!li->untagged)
		li->untagged = ecb;
}
if (li->untagged) {
	tag = 0;
	if ((li->busy != 1) && !li->used) {
		/* We need to issue this untagged command now */
		ecb = li->untagged;
		sc_link = ecb->xs->sc_link;
	}
	else {
		/* Not ready yet */
		splx(s)spllower(s);
		continue;
	}
}
ecb->tag[0] = tag;
if (tag) {
	int i;

	/* Allocate a tag */
	if (li->used == 255) {
		/* no free tags */
		splx(s)spllower(s);
		continue;
	}
	/* Start from the last used location */
	for (i=li->avail; i<256; i++) {
		if (li->queued[i] == NULL((void *)0))
			break;
	}
	/* Couldn't find one, start again from the beginning */
	if (i == 256) {
		for (i = 0; i<256; i++) {
			if (li->queued[i] == NULL((void *)0))
				break;
		}
	}
1019#ifdef DIAGNOSTIC1
	if (i == 256)
		panic("ncr53c9x_sched: tag alloc failure");
1022#endif

	/* Save where to start next time. */
	li->avail = i+1;
	li->used++;

	li->queued[i] = ecb;
	ecb->tag[1] = i;
}
splx(s)spllower(s);
if (li->untagged && (li->busy != 1)) {
	li->busy = 1;
	TAILQ_REMOVE(&sc->ready_list, ecb, chain)do { if (((ecb)->chain.tqe_next) != ((void *)0)) (ecb)->
chain.tqe_next->chain.tqe_prev = (ecb)->chain.tqe_prev;
 else (&sc->ready_list)->tqh_last = (ecb)->chain
.tqe_prev; *(ecb)->chain.tqe_prev = (ecb)->chain.tqe_next
; ((ecb)->chain.tqe_prev) = ((void *)-1); ((ecb)->chain
.tqe_next) = ((void *)-1); } while (0);
	ecb->flags &= ~ECB_READY0x02;
	sc->sc_nexus = ecb;
	ncr53c9x_select(sc, ecb);
	break;
}
if (!li->untagged && tag) {
	TAILQ_REMOVE(&sc->ready_list, ecb, chain)do { if (((ecb)->chain.tqe_next) != ((void *)0)) (ecb)->
chain.tqe_next->chain.tqe_prev = (ecb)->chain.tqe_prev;
 else (&sc->ready_list)->tqh_last = (ecb)->chain
.tqe_prev; *(ecb)->chain.tqe_prev = (ecb)->chain.tqe_next
; ((ecb)->chain.tqe_prev) = ((void *)-1); ((ecb)->chain
.tqe_next) = ((void *)-1); } while (0);
	ecb->flags &= ~ECB_READY0x02;
	sc->sc_nexus = ecb;
	ncr53c9x_select(sc, ecb);
	break;
} else
	NCR_MISC(("%d:%d busy\n",do {if (ncr53c9x_debug & 0x08) printf ("%d:%d busy\n", sc_link
->target, sc_link->lun);} while (0)
		  sc_link->target,do {if (ncr53c9x_debug & 0x08) printf ("%d:%d busy\n", sc_link
->target, sc_link->lun);} while (0)
		  sc_link->lun))do {if (ncr53c9x_debug & 0x08) printf ("%d:%d busy\n", sc_link
->target, sc_link->lun);} while (0);
}
1051}

1053void
1054ncr53c9x_sense(struct ncr53c9x_softc *sc, struct ncr53c9x_ecb *ecb)
1055{
struct scsi_xfer *xs = ecb->xs;
struct scsi_link *sc_link = xs->sc_link;
struct ncr53c9x_tinfo *ti = &sc->sc_tinfo[sc_link->target];
struct scsi_sense *ss = (void *)&ecb->cmd.cmd;
struct ncr53c9x_linfo *li;
int lun = sc_link->lun;

NCR_MISC(("requesting sense "))do {if (ncr53c9x_debug & 0x08) printf ("requesting sense "
);} while (0);
/* Next, setup a request sense command block */
bzero(ss, sizeof(*ss))__builtin_bzero((ss), (sizeof(*ss)));
ss->opcode = REQUEST_SENSE0x03;
ss->byte2 = sc_link->lun << 5;
ss->length = sizeof(struct scsi_sense_data);
ecb->clen = sizeof(*ss);
ecb->daddr = (char *)&xs->sense;
ecb->dleft = sizeof(struct scsi_sense_data);
ecb->flags |= ECB_SENSE0x04;
ecb->timeout = NCR_SENSE_TIMEOUT1000;
ti->senses++;
li = TINFO_LUN(ti, lun)((((lun) < 8) && (((ti)->lun[(lun)]) != ((void *
)0))) ? ((ti)->lun[(lun)]) : ncr53c9x_lunsearch((ti), (int64_t
)(lun)));
if (li->busy) li->busy = 0;
ncr53c9x_dequeue(sc, ecb);
li->untagged = ecb;
li->busy = 2;
if (ecb == sc->sc_nexus) {
ncr53c9x_select(sc, ecb);
} else {
TAILQ_INSERT_HEAD(&sc->ready_list, ecb, chain)do { if (((ecb)->chain.tqe_next = (&sc->ready_list)
->tqh_first) != ((void *)0)) (&sc->ready_list)->
tqh_first->chain.tqe_prev = &(ecb)->chain.tqe_next;
 else (&sc->ready_list)->tqh_last = &(ecb)->
chain.tqe_next; (&sc->ready_list)->tqh_first = (ecb
); (ecb)->chain.tqe_prev = &(&sc->ready_list)->
tqh_first; } while (0);
ecb->flags |= ECB_READY0x02;
if (sc->sc_state == NCR_IDLE1)
	ncr53c9x_sched(sc);
}
1088}

1090/*
* POST PROCESSING OF SCSI_CMD (usually current)
*/
1093void
1094ncr53c9x_done(struct ncr53c9x_softc *sc, struct ncr53c9x_ecb *ecb)
1095{
struct scsi_xfer *xs = ecb->xs;
struct scsi_link *sc_link = xs->sc_link;
struct ncr53c9x_tinfo *ti = &sc->sc_tinfo[sc_link->target];
int lun = sc_link->lun;
struct ncr53c9x_linfo *li = TINFO_LUN(ti, lun)((((lun) < 8) && (((ti)->lun[(lun)]) != ((void *
)0))) ? ((ti)->lun[(lun)]) : ncr53c9x_lunsearch((ti), (int64_t
)(lun)));

NCR_TRACE(("[ncr53c9x_done(error:%x)] ", xs->error))do {if (ncr53c9x_debug & 0x10) printf ("[ncr53c9x_done(error:%x)] "
, xs->error);} while (0);

timeout_del(&ecb->to);

if (ecb->stat == SCSI_QUEUE_FULL0x28) {
/*
 * Set current throttle -- we should reset
 * this periodically
 */
sc_link->openings = li->used - 1;
printf("\n%s: QFULL -- throttling to %d commands\n",
    sc->sc_dev.dv_xname, sc_link->openings);
}

/*
* Now, if we've come here with no error code, i.e. we've kept the
* initial XS_NOERROR, and the status code signals that we should
* check sense, we'll need to set up a request sense cmd block and
* push the command back into the ready queue *before* any other
* commands for this target/lunit, else we lose the sense info.
* We don't support chk sense conditions for the request sense cmd.
*/
if (xs->error == XS_NOERROR0) {
xs->status = ecb->stat;
if ((ecb->flags & ECB_ABORT0x40) != 0) {
	xs->error = XS_TIMEOUT4;
} else if ((ecb->flags & ECB_SENSE0x04) != 0) {
	xs->error = XS_SENSE1;
} else if ((ecb->stat & ST_MASK0x3e) == SCSI_CHECK0x02) {
	/* First, save the return values */
	xs->resid = ecb->dleft;
	ncr53c9x_sense(sc, ecb);
	return;
} else {
	xs->resid = ecb->dleft;
}
}

1140#ifdef NCR53C9X_DEBUG1
if (ncr53c9x_debug & NCR_SHOWMISC0x08) {
if (xs->resid != 0)
	printf("resid=%lu ", (unsigned long)xs->resid);
if (xs->error == XS_SENSE1)
	printf("sense=0x%02x\n", xs->sense.error_code);
else
	printf("error=%d\n", xs->error);
}
1149#endif

/*
* Remove the ECB from whatever queue it's on.
*/
ncr53c9x_dequeue(sc, ecb);
if (ecb == sc->sc_nexus) {
sc->sc_nexus = NULL((void *)0);
if (sc->sc_state != NCR_CLEANING8) {
	sc->sc_state = NCR_IDLE1;
	ncr53c9x_sched(sc);
}
}

ti->cmds++;
scsi_done(xs);
1165}

1167void
1168ncr53c9x_dequeue(struct ncr53c9x_softc *sc, struct ncr53c9x_ecb *ecb)
1169{
struct ncr53c9x_tinfo *ti =
   &sc->sc_tinfo[ecb->xs->sc_link->target];
struct ncr53c9x_linfo *li;
int64_t lun = ecb->xs->sc_link->lun;

li = TINFO_LUN(ti, lun)((((lun) < 8) && (((ti)->lun[(lun)]) != ((void *
)0))) ? ((ti)->lun[(lun)]) : ncr53c9x_lunsearch((ti), (int64_t
)(lun)));
1176#ifdef DIAGNOSTIC1
if ((!li) || (li->lun != lun))
panic("ncr53c9x_dequeue: lun %llx for ecb %p does not exist",
    (long long)lun, ecb);
1180#endif
if (li->untagged == ecb) {
li->busy = 0;
li->untagged = NULL((void *)0);
}
if (ecb->tag[0] && li->queued[ecb->tag[1]]) {
1186#ifdef DIAGNOSTIC1
if (li->queued[ecb->tag[1]] && (li->queued[ecb->tag[1]] != ecb))
	panic("ncr53c9x_dequeue: slot %d for lun %llx has %p "
	    "instead of ecb %p", ecb->tag[1],
	    (long long)lun,
	    li->queued[ecb->tag[1]], ecb);
1192#endif
li->queued[ecb->tag[1]] = NULL((void *)0);
li->used --;

}
if (ecb->flags & ECB_READY0x02) {
ecb->flags &= ~ECB_READY0x02;
TAILQ_REMOVE(&sc->ready_list, ecb, chain)do { if (((ecb)->chain.tqe_next) != ((void *)0)) (ecb)->
chain.tqe_next->chain.tqe_prev = (ecb)->chain.tqe_prev;
 else (&sc->ready_list)->tqh_last = (ecb)->chain
.tqe_prev; *(ecb)->chain.tqe_prev = (ecb)->chain.tqe_next
; ((ecb)->chain.tqe_prev) = ((void *)-1); ((ecb)->chain
.tqe_next) = ((void *)-1); } while (0);
}
}

1203/*
* INTERRUPT/PROTOCOL ENGINE
*/

1207/*
* Schedule an outgoing message by prioritizing it, and asserting
* attention on the bus. We can only do this when we are the initiator
* else there will be an illegal command interrupt.
*/
1212#define ncr53c9x_sched_msgout(m)do { do {if (ncr53c9x_debug & 0x08) printf ("ncr53c9x_sched_msgout %x %d "
, m, 1212);} while (0); do { if (ncr53c9x_debug & 0x100) printf
("<cmd:0x%x %d>", (unsigned)0x1a, 1212); sc->sc_lastcmd
 = 0x1a; (*(sc)->sc_glue->gl_write_reg)((sc), (0x03), (
0x1a)); } while (0); sc->sc_flags |= 0x40; sc->sc_msgpriq
 |= (m); } while (0) \
do {							\
NCR_MISC(("ncr53c9x_sched_msgout %x %d ", m, __LINE__))do {if (ncr53c9x_debug & 0x08) printf ("ncr53c9x_sched_msgout %x %d "
, m, 1214);} while (0);	\
NCRCMD(sc, NCRCMD_SETATN)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x1a, 1215); sc->sc_lastcmd = 0x1a; (*(sc)->
sc_glue->gl_write_reg)((sc), (0x03), (0x1a)); } while (0);			\
sc->sc_flags |= NCR_ATN0x40;			\
sc->sc_msgpriq |= (m);				\
} while (0)

1220static void
1221ncr53c9x_flushfifo(struct ncr53c9x_softc *sc)
1222{
NCR_MISC(("[flushfifo] "))do {if (ncr53c9x_debug & 0x08) printf ("[flushfifo] ");} while
 (0);

NCRCMD(sc, NCRCMD_FLUSH)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x01, 1225); sc->sc_lastcmd = 0x01; (*(sc)->
sc_glue->gl_write_reg)((sc), (0x03), (0x01)); } while (0);

if (sc->sc_phase == COMMAND_PHASE(0x02) ||
   sc->sc_phase == MESSAGE_OUT_PHASE(0x04|0x02))
DELAY(2)(*delay_func)(2);
1230}

1232static int
1233ncr53c9x_rdfifo(struct ncr53c9x_softc *sc, int how)
1234{
int i, n;
u_char *buf;

switch(how) {
case NCR_RDFIFO_START0:
buf = sc->sc_imess;
sc->sc_imlen = 0;
break;
case NCR_RDFIFO_CONTINUE1:
buf = sc->sc_imess + sc->sc_imlen;
break;
default:
panic("ncr53c9x_rdfifo: bad flag");
break;
}

/*
* XXX buffer (sc_imess) size for message
*/

n = NCR_READ_REG(sc, NCR_FFLAG)(*(sc)->sc_glue->gl_read_reg)((sc), (0x07)) & NCRFIFO_FF0x1f;

if (sc->sc_rev == NCR_VARIANT_FAS3669) {
n *= 2;

for (i = 0; i < n; i++)
	buf[i] = NCR_READ_REG(sc, NCR_FIFO)(*(sc)->sc_glue->gl_read_reg)((sc), (0x02));

if (sc->sc_espstat2 & FAS_STAT2_ISHUTTLE0x20) {

	NCR_WRITE_REG(sc, NCR_FIFO, 0)(*(sc)->sc_glue->gl_write_reg)((sc), (0x02), (0));
	buf[i++] = NCR_READ_REG(sc, NCR_FIFO)(*(sc)->sc_glue->gl_read_reg)((sc), (0x02));

	NCR_READ_REG(sc, NCR_FIFO)(*(sc)->sc_glue->gl_read_reg)((sc), (0x02));

	ncr53c9x_flushfifo(sc);
}
} else {
for (i = 0; i < n; i++)
	buf[i] = NCR_READ_REG(sc, NCR_FIFO)(*(sc)->sc_glue->gl_read_reg)((sc), (0x02));
}

sc->sc_imlen += i;

1279#ifdef NCR53C9X_DEBUG1
{
int j;

NCR_TRACE(("\n[rdfifo %s (%d):",do {if (ncr53c9x_debug & 0x10) printf ("\n[rdfifo %s (%d):"
, (how == 0) ? "start" : "cont", (int)sc->sc_imlen);} while
 (0)
    (how == NCR_RDFIFO_START) ? "start" : "cont",do {if (ncr53c9x_debug & 0x10) printf ("\n[rdfifo %s (%d):"
, (how == 0) ? "start" : "cont", (int)sc->sc_imlen);} while
 (0)
    (int)sc->sc_imlen))do {if (ncr53c9x_debug & 0x10) printf ("\n[rdfifo %s (%d):"
, (how == 0) ? "start" : "cont", (int)sc->sc_imlen);} while
 (0);
if (ncr53c9x_debug & NCR_SHOWTRAC0x10) {
	for (j = 0; j < sc->sc_imlen; j++)
		printf(" %02x", sc->sc_imess[j]);
	printf("]\n");
}
}
1292#endif
return sc->sc_imlen;
1294}

1296static void
1297ncr53c9x_wrfifo(struct ncr53c9x_softc *sc, u_char *p, int len)
1298{
int i;

1301#ifdef NCR53C9X_DEBUG1
NCR_MISC(("[wrfifo(%d):", len))do {if (ncr53c9x_debug & 0x08) printf ("[wrfifo(%d):", len
);} while (0);
if (ncr53c9x_debug & NCR_SHOWTRAC0x10) {
for (i = 0; i < len; i++)
	printf(" %02x", p[i]);
printf("]\n");
}
1308#endif

for (i = 0; i < len; i++) {
NCR_WRITE_REG(sc, NCR_FIFO, p[i])(*(sc)->sc_glue->gl_write_reg)((sc), (0x02), (p[i]));

if (sc->sc_rev == NCR_VARIANT_FAS3669)
	NCR_WRITE_REG(sc, NCR_FIFO, 0)(*(sc)->sc_glue->gl_write_reg)((sc), (0x02), (0));
}
1316}

1318int
1319ncr53c9x_reselect(struct ncr53c9x_softc *sc, int message, int tagtype,
  int tagid)
1321{
u_char selid, target, lun;
struct ncr53c9x_ecb *ecb = NULL((void *)0);
struct ncr53c9x_tinfo *ti;
struct ncr53c9x_linfo *li;

if (sc->sc_rev == NCR_VARIANT_FAS3669) {
target = sc->sc_selid;
} else {
/*
 * The SCSI chip made a snapshot of the data bus while the reselection
 * was being negotiated.  This enables us to determine which target did
 * the reselect.
 */
selid = sc->sc_selid & ~(1 << sc->sc_id);
if (selid & (selid - 1)) {
	printf("%s: reselect with invalid selid %02x;"
	    " sending DEVICE RESET\n", sc->sc_dev.dv_xname, selid);
	goto reset;

}
target = ffs(selid) - 1;
}
lun = message & 0x07;

/*
* Search wait queue for disconnected cmd
* The list should be short, so I haven't bothered with
* any more sophisticated structures than a simple
* singly linked list.
*/
ti = &sc->sc_tinfo[target];
li = TINFO_LUN(ti, lun)((((lun) < 8) && (((ti)->lun[(lun)]) != ((void *
)0))) ? ((ti)->lun[(lun)]) : ncr53c9x_lunsearch((ti), (int64_t
)(lun)));

/*
* We can get as far as the LUN with the IDENTIFY
* message.  Check to see if we're running an
* un-tagged command.  Otherwise ack the IDENTIFY
* and wait for a tag message.
*/
if (li != NULL((void *)0)) {
if (li->untagged != NULL((void *)0) && li->busy)
	ecb = li->untagged;
else if (tagtype != MSG_SIMPLE_Q_TAG0x20) {
	/* Wait for tag to come by */
	sc->sc_state = NCR_IDENTIFIED4;
	return (0);
} else if (tagtype) ecb = li->queued[tagid];
}
if (ecb == NULL((void *)0)) {
printf("%s: reselect from target %d lun %d tag %x:%x with no nexus;"
    " sending ABORT\n", sc->sc_dev.dv_xname, target, lun, tagtype, tagid);
goto abort;
}

/* Make this nexus active again. */
sc->sc_state = NCR_CONNECTED5;
sc->sc_nexus = ecb;
ncr53c9x_setsync(sc, ti);

if (ecb->flags & ECB_RESET0x80)
ncr53c9x_sched_msgout(SEND_DEV_RESET)do { do {if (ncr53c9x_debug & 0x08) printf ("ncr53c9x_sched_msgout %x %d "
, 0x0001, 1382);} while (0); do { if (ncr53c9x_debug & 0x100
) printf("<cmd:0x%x %d>", (unsigned)0x1a, 1382); sc->
sc_lastcmd = 0x1a; (*(sc)->sc_glue->gl_write_reg)((sc),
 (0x03), (0x1a)); } while (0); sc->sc_flags |= 0x40; sc->
sc_msgpriq |= (0x0001); } while (0);
else if (ecb->flags & ECB_ABORT0x40)
ncr53c9x_sched_msgout(SEND_ABORT)do { do {if (ncr53c9x_debug & 0x08) printf ("ncr53c9x_sched_msgout %x %d "
, 0x0020, 1384);} while (0); do { if (ncr53c9x_debug & 0x100
) printf("<cmd:0x%x %d>", (unsigned)0x1a, 1384); sc->
sc_lastcmd = 0x1a; (*(sc)->sc_glue->gl_write_reg)((sc),
 (0x03), (0x1a)); } while (0); sc->sc_flags |= 0x40; sc->
sc_msgpriq |= (0x0020); } while (0);

/* Do an implicit RESTORE POINTERS. */
sc->sc_dp = ecb->daddr;
sc->sc_dleft = ecb->dleft;

return (0);

1392reset:
ncr53c9x_sched_msgout(SEND_DEV_RESET)do { do {if (ncr53c9x_debug & 0x08) printf ("ncr53c9x_sched_msgout %x %d "
, 0x0001, 1393);} while (0); do { if (ncr53c9x_debug & 0x100
) printf("<cmd:0x%x %d>", (unsigned)0x1a, 1393); sc->
sc_lastcmd = 0x1a; (*(sc)->sc_glue->gl_write_reg)((sc),
 (0x03), (0x1a)); } while (0); sc->sc_flags |= 0x40; sc->
sc_msgpriq |= (0x0001); } while (0);
return (1);

1396abort:
ncr53c9x_sched_msgout(SEND_ABORT)do { do {if (ncr53c9x_debug & 0x08) printf ("ncr53c9x_sched_msgout %x %d "
, 0x0020, 1397);} while (0); do { if (ncr53c9x_debug & 0x100
) printf("<cmd:0x%x %d>", (unsigned)0x1a, 1397); sc->
sc_lastcmd = 0x1a; (*(sc)->sc_glue->gl_write_reg)((sc),
 (0x03), (0x1a)); } while (0); sc->sc_flags |= 0x40; sc->
sc_msgpriq |= (0x0020); } while (0);
return (1);
1399}

1401static inline int
1402__verify_msg_format(u_char *p, int len)
1403{

if (len == 1 && IS1BYTEMSG(p[0])(((p[0]) != 0x01 && (p[0]) < 0x20) || (p[0]) >=
 0x80))
return 1;
if (len == 2 && IS2BYTEMSG(p[0])(((p[0]) & 0xf0) == 0x20))
return 1;
if (len >= 3 && ISEXTMSG(p[0])((p[0]) == 0x01) &&
   len == p[1] + 2)
return 1;

return 0;
1414}

1416/*
* Get an incoming message as initiator.
*
* The SCSI bus must already be in MESSAGE_IN_PHASE and there is a
* byte in the FIFO
*/
1422void
1423ncr53c9x_msgin(struct ncr53c9x_softc *sc)
1424{

NCR_TRACE(("[ncr53c9x_msgin(curmsglen:%ld)] ", (long)sc->sc_imlen))do {if (ncr53c9x_debug & 0x10) printf ("[ncr53c9x_msgin(curmsglen:%ld)] "
, (long)sc->sc_imlen);} while (0);

if (sc->sc_imlen == 0) {
printf("%s: msgin: no msg byte available\n", sc->sc_dev.dv_xname);
return;
}

/*
* Prepare for a new message.  A message should (according
* to the SCSI standard) be transmitted in one single
* MESSAGE_IN_PHASE. If we have been in some other phase,
* then this is a new message.
*/
if (sc->sc_prevphase != MESSAGE_IN_PHASE(0x04|0x02|0x01) && sc->sc_state != NCR_RESELECTED3) {
printf("%s: phase change, dropping message, prev %d, state %d\n",
    sc->sc_dev.dv_xname, sc->sc_prevphase, sc->sc_state);
sc->sc_flags &= ~NCR_DROP_MSGI0x01;
sc->sc_imlen = 0;
}

NCR_TRACE(("<msgbyte:0x%02x>", sc->sc_imess[0]))do {if (ncr53c9x_debug & 0x10) printf ("<msgbyte:0x%02x>"
, sc->sc_imess[0]);} while (0);

/*
* If we're going to reject the message, don't bother storing
* the incoming bytes.  But still, we need to ACK them.
*/
if ((sc->sc_flags & NCR_DROP_MSGI0x01)) {
NCRCMD(sc, NCRCMD_MSGOK)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x12, 1453); sc->sc_lastcmd = 0x12; (*(sc)->
sc_glue->gl_write_reg)((sc), (0x03), (0x12)); } while (0);
printf("<dropping msg byte %x>",
	sc->sc_imess[sc->sc_imlen]);
return;
}

if (sc->sc_imlen >= NCR_MAX_MSG_LEN8) {
ncr53c9x_sched_msgout(SEND_REJECT)do { do {if (ncr53c9x_debug & 0x08) printf ("ncr53c9x_sched_msgout %x %d "
, 0x0008, 1460);} while (0); do { if (ncr53c9x_debug & 0x100
) printf("<cmd:0x%x %d>", (unsigned)0x1a, 1460); sc->
sc_lastcmd = 0x1a; (*(sc)->sc_glue->gl_write_reg)((sc),
 (0x03), (0x1a)); } while (0); sc->sc_flags |= 0x40; sc->
sc_msgpriq |= (0x0008); } while (0);
sc->sc_flags |= NCR_DROP_MSGI0x01;
} else {
u_char *pb;
int plen;

switch (sc->sc_state) {
	/*
	 * if received message is the first of reselection
	 * then first byte is selid, and then message
	 */
case NCR_RESELECTED3:
	pb = sc->sc_imess + 1;
	plen = sc->sc_imlen - 1;
	break;
default:
	pb = sc->sc_imess;
	plen = sc->sc_imlen;
	break;
}

if (__verify_msg_format(pb, plen))
	goto gotit;
}

/* Ack what we have so far */
NCRCMD(sc, NCRCMD_MSGOK)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x12, 1486); sc->sc_lastcmd = 0x12; (*(sc)->
sc_glue->gl_write_reg)((sc), (0x03), (0x12)); } while (0);
return;

1489gotit:
NCR_MSGS(("gotmsg(%x) state %d", sc->sc_imess[0], sc->sc_state))do {if (ncr53c9x_debug & 0x200) printf ("gotmsg(%x) state %d"
, sc->sc_imess[0], sc->sc_state);}while (0);
/* we got complete message, flush the imess, XXX nobody uses imlen below */
sc->sc_imlen = 0;

/*
* Now we should have a complete message (1 byte, 2 byte
* and moderately long extended messages).  We only handle
* extended messages which total length is shorter than
* NCR_MAX_MSG_LEN.  Longer messages will be amputated.
*/
switch (sc->sc_state) {
struct ncr53c9x_ecb *ecb;
struct ncr53c9x_tinfo *ti;
struct ncr53c9x_linfo *li;
int lun;

case NCR_CONNECTED5:
ecb = sc->sc_nexus;
ti = &sc->sc_tinfo[ecb->xs->sc_link->target];

switch (sc->sc_imess[0]) {
case MSG_CMDCOMPLETE0x00:
	NCR_MSGS(("cmdcomplete "))do {if (ncr53c9x_debug & 0x200) printf ("cmdcomplete ");}
while (0);
	if (sc->sc_dleft < 0) {
		sc_print_addr(ecb->xs->sc_link);
		printf("got %ld extra bytes\n",
		    -(long)sc->sc_dleft);
		sc->sc_dleft = 0;
	}
	ecb->dleft = (ecb->flags & ECB_TENTATIVE_DONE0x100)
		? 0
		: sc->sc_dleft;
	if ((ecb->flags & ECB_SENSE0x04) == 0)
		ecb->xs->resid = ecb->dleft;
	sc->sc_state = NCR_CMDCOMPLETE7;
	break;

case MSG_MESSAGE_REJECT0x07:
	NCR_MSGS(("msg reject (msgout=%x) ", sc->sc_msgout))do {if (ncr53c9x_debug & 0x200) printf ("msg reject (msgout=%x) "
, sc->sc_msgout);}while (0);
	switch (sc->sc_msgout) {
	case SEND_TAG0x0100:
		/* Target does not like tagged queuing.
		 *  - Flush the command queue
		 *  - Disable tagged queuing for the target
		 *  - Dequeue ecb from the queued array.
		 */
		printf("%s: tagged queuing rejected: target %d\n",
		    sc->sc_dev.dv_xname, ecb->xs->sc_link->target);

		NCR_MSGS(("(rejected sent tag)"))do {if (ncr53c9x_debug & 0x200) printf ("(rejected sent tag)"
);}while (0);
		NCRCMD(sc, NCRCMD_FLUSH)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x01, 1540); sc->sc_lastcmd = 0x01; (*(sc)->
sc_glue->gl_write_reg)((sc), (0x03), (0x01)); } while (0);
		DELAY(1)(*delay_func)(1);
		ti->flags &= ~T_TAG0x40;
		lun = ecb->xs->sc_link->lun;
		li = TINFO_LUN(ti, lun)((((lun) < 8) && (((ti)->lun[(lun)]) != ((void *
)0))) ? ((ti)->lun[(lun)]) : ncr53c9x_lunsearch((ti), (int64_t
)(lun)));
		if (ecb->tag[0] &&
		    li->queued[ecb->tag[1]] != NULL((void *)0)) {
			li->queued[ecb->tag[1]] = NULL((void *)0);
			li->used--;
		}
		ecb->tag[0] = ecb->tag[1] = 0;
		li->untagged = ecb;
		li->busy = 1;
		break;

	case SEND_SDTR0x0080:
		printf("%s: sync transfer rejected: target %d\n",
		    sc->sc_dev.dv_xname, ecb->xs->sc_link->target);
		sc->sc_flags &= ~NCR_SYNCHNEGO0x08;
		ti->flags &= ~(T_NEGOTIATE0x02 | T_SYNCMODE0x08);
		ncr53c9x_setsync(sc, ti);
		break;

	case SEND_WDTR0x0040:
		printf("%s: wide transfer rejected: target %d\n",
		    sc->sc_dev.dv_xname, ecb->xs->sc_link->target);
		ti->flags &= ~T_WIDE0x80;
		ti->width = 0;
		break;

	case SEND_INIT_DET_ERR0x0004:
		goto abort;
	}
	break;

case MSG_NOOP0x08:
	NCR_MSGS(("noop "))do {if (ncr53c9x_debug & 0x200) printf ("noop ");}while (
0);
	break;

case MSG_HEAD_OF_Q_TAG0x21:
case MSG_SIMPLE_Q_TAG0x20:
case MSG_ORDERED_Q_TAG0x22:
	NCR_MSGS(("TAG %x:%x", sc->sc_imess[0], sc->sc_imess[1]))do {if (ncr53c9x_debug & 0x200) printf ("TAG %x:%x", sc->
sc_imess[0], sc->sc_imess[1]);}while (0);
	break;

case MSG_DISCONNECT0x04:
	NCR_MSGS(("disconnect "))do {if (ncr53c9x_debug & 0x200) printf ("disconnect ");}while
 (0);
	ti->dconns++;
	sc->sc_state = NCR_DISCONNECT6;

	/*
	 * Mark the fact that all bytes have moved. The
	 * target may not bother to do a SAVE POINTERS
	 * at this stage. This flag will set the residual
	 * count to zero on MSG COMPLETE.
	 */
	if (sc->sc_dleft == 0)
		ecb->flags |= ECB_TENTATIVE_DONE0x100;

	break;

case MSG_SAVEDATAPOINTER0x02:
	NCR_MSGS(("save datapointer "))do {if (ncr53c9x_debug & 0x200) printf ("save datapointer "
);}while (0);
	ecb->daddr = sc->sc_dp;
	ecb->dleft = sc->sc_dleft;
	break;

case MSG_RESTOREPOINTERS0x03:
	NCR_MSGS(("restore datapointer "))do {if (ncr53c9x_debug & 0x200) printf ("restore datapointer "
);}while (0);
	sc->sc_dp = ecb->daddr;
	sc->sc_dleft = ecb->dleft;
	break;

case MSG_EXTENDED0x01:
	NCR_MSGS(("extended(%x) ", sc->sc_imess[2]))do {if (ncr53c9x_debug & 0x200) printf ("extended(%x) ", sc
->sc_imess[2]);}while (0);
	switch (sc->sc_imess[2]) {
	case MSG_EXT_SDTR0x01:
		NCR_MSGS(("SDTR period %d, offset %d ",do {if (ncr53c9x_debug & 0x200) printf ("SDTR period %d, offset %d "
, sc->sc_imess[3], sc->sc_imess[4]);}while (0)
			sc->sc_imess[3], sc->sc_imess[4]))do {if (ncr53c9x_debug & 0x200) printf ("SDTR period %d, offset %d "
, sc->sc_imess[3], sc->sc_imess[4]);}while (0);
		if (sc->sc_imess[1] != 3)
			goto reject;
		ti->period = sc->sc_imess[3];
		ti->offset = sc->sc_imess[4];
		ti->flags &= ~T_NEGOTIATE0x02;
		if (sc->sc_minsync == 0 ||
		    ti->offset == 0 ||
		    ti->period > 124) {
1627#ifdef NCR53C9X_DEBUG1
			sc_print_addr(ecb->xs->sc_link);
			printf("async mode\n");
1630#endif
			if ((sc->sc_flags&NCR_SYNCHNEGO0x08)
			    == 0) {
				/*
				 * target initiated negotiation
				 */
				ti->offset = 0;
				ti->flags &= ~T_SYNCMODE0x08;
				ncr53c9x_sched_msgout(do { do {if (ncr53c9x_debug & 0x08) printf ("ncr53c9x_sched_msgout %x %d "
, 0x0080, 1639);} while (0); do { if (ncr53c9x_debug & 0x100
) printf("<cmd:0x%x %d>", (unsigned)0x1a, 1639); sc->
sc_lastcmd = 0x1a; (*(sc)->sc_glue->gl_write_reg)((sc),
 (0x03), (0x1a)); } while (0); sc->sc_flags |= 0x40; sc->
sc_msgpriq |= (0x0080); } while (0)
				    SEND_SDTR)do { do {if (ncr53c9x_debug & 0x08) printf ("ncr53c9x_sched_msgout %x %d "
, 0x0080, 1639);} while (0); do { if (ncr53c9x_debug & 0x100
) printf("<cmd:0x%x %d>", (unsigned)0x1a, 1639); sc->
sc_lastcmd = 0x1a; (*(sc)->sc_glue->gl_write_reg)((sc),
 (0x03), (0x1a)); } while (0); sc->sc_flags |= 0x40; sc->
sc_msgpriq |= (0x0080); } while (0);
			} else {
				/* we are async */
				ti->flags &= ~T_SYNCMODE0x08;
			}
		} else {
1645#ifdef NCR53C9X_DEBUG1
			int r, s;
1647#endif
			int p;

			p = ncr53c9x_stp2cpb(sc, ti->period);
			ti->period = ncr53c9x_cpb2stp(sc, p)((250 * (p)) / (sc)->sc_freq);
1652#ifdef NCR53C9X_DEBUG1
			sc_print_addr(ecb->xs->sc_link);
			r = 250/ti->period;
			s = (100*250)/ti->period - 100*r;
			printf("max sync rate %d.%02dMB/s\n",
				r, s);
1658#endif
			if ((sc->sc_flags&NCR_SYNCHNEGO0x08) == 0) {
				/*
				 * target initiated negotiation
				 */
				if (ti->period <
				    sc->sc_minsync)
					ti->period =
					    sc->sc_minsync;
				if (ti->offset > 15)
					ti->offset = 15;
				ti->flags &= ~T_SYNCMODE0x08;
				ncr53c9x_sched_msgout(do { do {if (ncr53c9x_debug & 0x08) printf ("ncr53c9x_sched_msgout %x %d "
, 0x0080, 1671);} while (0); do { if (ncr53c9x_debug & 0x100
) printf("<cmd:0x%x %d>", (unsigned)0x1a, 1671); sc->
sc_lastcmd = 0x1a; (*(sc)->sc_glue->gl_write_reg)((sc),
 (0x03), (0x1a)); } while (0); sc->sc_flags |= 0x40; sc->
sc_msgpriq |= (0x0080); } while (0)
				    SEND_SDTR)do { do {if (ncr53c9x_debug & 0x08) printf ("ncr53c9x_sched_msgout %x %d "
, 0x0080, 1671);} while (0); do { if (ncr53c9x_debug & 0x100
) printf("<cmd:0x%x %d>", (unsigned)0x1a, 1671); sc->
sc_lastcmd = 0x1a; (*(sc)->sc_glue->gl_write_reg)((sc),
 (0x03), (0x1a)); } while (0); sc->sc_flags |= 0x40; sc->
sc_msgpriq |= (0x0080); } while (0);
			} else {
				/* we are sync */
				ti->flags |= T_SYNCMODE0x08;
			}
		}
		sc->sc_flags &= ~NCR_SYNCHNEGO0x08;
		ncr53c9x_setsync(sc, ti);
		break;

	case MSG_EXT_WDTR0x03:
		printf("%s: wide mode %d\n",
		    sc->sc_dev.dv_xname, sc->sc_imess[3]);
		if (sc->sc_imess[3] == 1) {
			ti->cfg3 |= NCRFASCFG3_EWIDE0x40;
			ncr53c9x_setsync(sc, ti);
		} else
			ti->width = 0;
		ti->flags &= ~T_WIDE0x80;
		break;
	default:
		sc_print_addr(ecb->xs->sc_link);
		printf("unrecognized MESSAGE EXTENDED;"
		    " sending REJECT\n");
		goto reject;
	}
	break;

default:
	NCR_MSGS(("ident "))do {if (ncr53c9x_debug & 0x200) printf ("ident ");}while (
0);
	sc_print_addr(ecb->xs->sc_link);
	printf("unrecognized MESSAGE; sending REJECT\n");
reject:
	ncr53c9x_sched_msgout(SEND_REJECT)do { do {if (ncr53c9x_debug & 0x08) printf ("ncr53c9x_sched_msgout %x %d "
, 0x0008, 1704);} while (0); do { if (ncr53c9x_debug & 0x100
) printf("<cmd:0x%x %d>", (unsigned)0x1a, 1704); sc->
sc_lastcmd = 0x1a; (*(sc)->sc_glue->gl_write_reg)((sc),
 (0x03), (0x1a)); } while (0); sc->sc_flags |= 0x40; sc->
sc_msgpriq |= (0x0008); } while (0);
	break;
}
break;

case NCR_IDENTIFIED4:
/*
 * IDENTIFY message was received and queue tag is expected now
 */
if ((sc->sc_imess[0] != MSG_SIMPLE_Q_TAG0x20) ||
    (sc->sc_msgify == 0)) {
	printf("%s: TAG reselect without IDENTIFY;"
	    " MSG %x;"
	    " sending DEVICE RESET\n",
	    sc->sc_dev.dv_xname,
	    sc->sc_imess[0]);
	goto reset;
}
(void) ncr53c9x_reselect(sc, sc->sc_msgify,
    sc->sc_imess[0], sc->sc_imess[1]);
break;

case NCR_RESELECTED3:
if (MSG_ISIDENTIFY(sc->sc_imess[1])((sc->sc_imess[1]) & 0x80)) {
	sc->sc_msgify = sc->sc_imess[1];
} else {
	printf("%s: reselect without IDENTIFY;"
	    " MSG %x;"
	    " sending DEVICE RESET\n",
	    sc->sc_dev.dv_xname,
	    sc->sc_imess[1]);
	goto reset;
}
(void) ncr53c9x_reselect(sc, sc->sc_msgify, 0, 0);
break;

default:
printf("%s: unexpected MESSAGE IN; sending DEVICE RESET\n",
    sc->sc_dev.dv_xname);
reset:
ncr53c9x_sched_msgout(SEND_DEV_RESET)do { do {if (ncr53c9x_debug & 0x08) printf ("ncr53c9x_sched_msgout %x %d "
, 0x0001, 1744);} while (0); do { if (ncr53c9x_debug & 0x100
) printf("<cmd:0x%x %d>", (unsigned)0x1a, 1744); sc->
sc_lastcmd = 0x1a; (*(sc)->sc_glue->gl_write_reg)((sc),
 (0x03), (0x1a)); } while (0); sc->sc_flags |= 0x40; sc->
sc_msgpriq |= (0x0001); } while (0);
break;

abort:
ncr53c9x_sched_msgout(SEND_ABORT)do { do {if (ncr53c9x_debug & 0x08) printf ("ncr53c9x_sched_msgout %x %d "
, 0x0020, 1748);} while (0); do { if (ncr53c9x_debug & 0x100
) printf("<cmd:0x%x %d>", (unsigned)0x1a, 1748); sc->
sc_lastcmd = 0x1a; (*(sc)->sc_glue->gl_write_reg)((sc),
 (0x03), (0x1a)); } while (0); sc->sc_flags |= 0x40; sc->
sc_msgpriq |= (0x0020); } while (0);
break;
}

/* if we have more messages to send set ATN */
if (sc->sc_msgpriq)
NCRCMD(sc, NCRCMD_SETATN)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x1a, 1754); sc->sc_lastcmd = 0x1a; (*(sc)->
sc_glue->gl_write_reg)((sc), (0x03), (0x1a)); } while (0);

/* Ack last message byte */
NCRCMD(sc, NCRCMD_MSGOK)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x12, 1757); sc->sc_lastcmd = 0x12; (*(sc)->
sc_glue->gl_write_reg)((sc), (0x03), (0x12)); } while (0);

/* Done, reset message pointer. */
sc->sc_flags &= ~NCR_DROP_MSGI0x01;
sc->sc_imlen = 0;
1762}


1765/*
* Send the highest priority, scheduled message
*/
1768void
1769ncr53c9x_msgout(struct ncr53c9x_softc *sc)
1770{
struct ncr53c9x_tinfo *ti;
struct ncr53c9x_ecb *ecb;
size_t size;

NCR_TRACE(("[ncr53c9x_msgout(priq:%x, prevphase:%x)]",do {if (ncr53c9x_debug & 0x10) printf ("[ncr53c9x_msgout(priq:%x, prevphase:%x)]"
, sc->sc_msgpriq, sc->sc_prevphase);} while (0)
   sc->sc_msgpriq, sc->sc_prevphase))do {if (ncr53c9x_debug & 0x10) printf ("[ncr53c9x_msgout(priq:%x, prevphase:%x)]"
, sc->sc_msgpriq, sc->sc_prevphase);} while (0);

/*
* XXX - the NCR_ATN flag is not in sync with the actual ATN
*	 condition on the SCSI bus. The 53c9x chip
*	 automatically turns off ATN before sending the
*	 message byte.  (see also the comment below in the
*	 default case when picking out a message to send)
*/
if (sc->sc_flags & NCR_ATN0x40) {
if (sc->sc_prevphase != MESSAGE_OUT_PHASE(0x04|0x02)) {
new:
	NCRCMD(sc, NCRCMD_FLUSH)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x01, 1788); sc->sc_lastcmd = 0x01; (*(sc)->
sc_glue->gl_write_reg)((sc), (0x03), (0x01)); } while (0);
1789/*			DELAY(1); */
	sc->sc_msgoutq = 0;
	sc->sc_omlen = 0;
}
} else {
if (sc->sc_prevphase == MESSAGE_OUT_PHASE(0x04|0x02)) {
	ncr53c9x_sched_msgout(sc->sc_msgoutq)do { do {if (ncr53c9x_debug & 0x08) printf ("ncr53c9x_sched_msgout %x %d "
, sc->sc_msgoutq, 1795);} while (0); do { if (ncr53c9x_debug
 & 0x100) printf("<cmd:0x%x %d>", (unsigned)0x1a, 1795
); sc->sc_lastcmd = 0x1a; (*(sc)->sc_glue->gl_write_reg
)((sc), (0x03), (0x1a)); } while (0); sc->sc_flags |= 0x40
; sc->sc_msgpriq |= (sc->sc_msgoutq); } while (0);
	goto new;
} else {
	printf("%s at line %d: unexpected MESSAGE OUT phase\n",
	    sc->sc_dev.dv_xname, __LINE__1799);
}
}

if (sc->sc_omlen == 0) {
/* Pick up highest priority message */
sc->sc_msgout = sc->sc_msgpriq & -sc->sc_msgpriq;
sc->sc_msgoutq |= sc->sc_msgout;
sc->sc_msgpriq &= ~sc->sc_msgout;
sc->sc_omlen = 1;		/* "Default" message len */
switch (sc->sc_msgout) {
case SEND_SDTR0x0080:
	ecb = sc->sc_nexus;
	ti = &sc->sc_tinfo[ecb->xs->sc_link->target];
	sc->sc_omess[0] = MSG_EXTENDED0x01;
	sc->sc_omess[1] = 3;
	sc->sc_omess[2] = MSG_EXT_SDTR0x01;
	sc->sc_omess[3] = ti->period;
	sc->sc_omess[4] = ti->offset;
	sc->sc_omlen = 5;
	if ((sc->sc_flags & NCR_SYNCHNEGO0x08) == 0) {
		ti->flags |= T_SYNCMODE0x08;
		ncr53c9x_setsync(sc, ti);
	}
	break;
case SEND_WDTR0x0040:
	ecb = sc->sc_nexus;
	ti = &sc->sc_tinfo[ecb->xs->sc_link->target];
	sc->sc_omess[0] = MSG_EXTENDED0x01;
	sc->sc_omess[1] = 2;
	sc->sc_omess[2] = MSG_EXT_WDTR0x03;
	sc->sc_omess[3] = ti->width;
	sc->sc_omlen = 4;
	break;
case SEND_IDENTIFY0x0010:
	if (sc->sc_state != NCR_CONNECTED5) {
		printf("%s at line %d: no nexus\n",
		    sc->sc_dev.dv_xname, __LINE__1836);
	}
	ecb = sc->sc_nexus;
	sc->sc_omess[0] =
	    MSG_IDENTIFY(ecb->xs->sc_link->lun, 0)(((0) ? 0xc0 : 0x80) | (ecb->xs->sc_link->lun));
	break;
case SEND_TAG0x0100:
	if (sc->sc_state != NCR_CONNECTED5) {
		printf("%s at line %d: no nexus\n",
		    sc->sc_dev.dv_xname, __LINE__1845);
	}
	ecb = sc->sc_nexus;
	sc->sc_omess[0] = ecb->tag[0];
	sc->sc_omess[1] = ecb->tag[1];
	sc->sc_omlen = 2;
	break;
case SEND_DEV_RESET0x0001:
	sc->sc_flags |= NCR_ABORTING0x02;
	sc->sc_omess[0] = MSG_BUS_DEV_RESET0x0c;
	ecb = sc->sc_nexus;
	ti = &sc->sc_tinfo[ecb->xs->sc_link->target];
	ti->flags &= ~T_SYNCMODE0x08;
	if ((ti->flags & T_SYNCHOFF0x10) == 0)
		/* We can re-start sync negotiation */
		ti->flags |= T_NEGOTIATE0x02;
	break;
case SEND_PARITY_ERROR0x0002:
	sc->sc_omess[0] = MSG_PARITY_ERROR0x09;
	break;
case SEND_ABORT0x0020:
	sc->sc_flags |= NCR_ABORTING0x02;
	sc->sc_omess[0] = MSG_ABORT0x06;
	break;
case SEND_INIT_DET_ERR0x0004:
	sc->sc_omess[0] = MSG_INITIATOR_DET_ERR0x05;
	break;
case SEND_REJECT0x0008:
	sc->sc_omess[0] = MSG_MESSAGE_REJECT0x07;
	break;
default:
	/*
	 * We normally do not get here, since the chip
	 * automatically turns off ATN before the last
	 * byte of a message is sent to the target.
	 * However, if the target rejects our (multi-byte)
	 * message early by switching to MSG IN phase
	 * ATN remains on, so the target may return to
	 * MSG OUT phase. If there are no scheduled messages
	 * left we send a NO-OP.
	 *
	 * XXX - Note that this leaves no useful purpose for
	 * the NCR_ATN flag.
	 */
	sc->sc_flags &= ~NCR_ATN0x40;
	sc->sc_omess[0] = MSG_NOOP0x08;
	break;
}
sc->sc_omp = sc->sc_omess;
}

1896#ifdef DEBUG
{
int i;

for (i = 0; i<sc->sc_omlen; i++)
	NCR_MISC(("<msgbyte:0x%02x>", sc->sc_omess[i]))do {if (ncr53c9x_debug & 0x08) printf ("<msgbyte:0x%02x>"
, sc->sc_omess[i]);} while (0);
}
1903#endif
if (sc->sc_rev == NCR_VARIANT_FAS3669) {
/*
 * XXX fifo size
 */
ncr53c9x_flushfifo(sc);
ncr53c9x_wrfifo(sc, sc->sc_omp, sc->sc_omlen);
sc->sc_cmdlen = 0;
NCRCMD(sc, NCRCMD_TRANS)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x10, 1911); sc->sc_lastcmd = 0x10; (*(sc)->
sc_glue->gl_write_reg)((sc), (0x03), (0x10)); } while (0);
} else {
/* (re)send the message */
size = min(sc->sc_omlen, sc->sc_maxxfer);
NCRDMA_SETUP(sc, &sc->sc_omp, &sc->sc_omlen, 0, &size)(*(sc)->sc_glue->gl_dma_setup)((sc), (&sc->sc_omp
), (&sc->sc_omlen), (0), (&size));
/* Program the SCSI counter */
NCR_SET_COUNT(sc, size)do { (*((sc))->sc_glue->gl_write_reg)(((sc)), (0x00), (
(size))); (*((sc))->sc_glue->gl_write_reg)(((sc)), (0x01
), ((size) >> 8)); if ((sc->sc_cfg2 & 0x40) || (
sc->sc_rev == 9)) { (*((sc))->sc_glue->gl_write_reg)
(((sc)), (0x0e), ((size) >> 16)); } if (sc->sc_rev ==
 9) { (*(sc)->sc_glue->gl_write_reg)((sc), (0xf), (0));
 } } while (0);

             /* Load the count in and start the message-out transfer */
NCRCMD(sc, NCRCMD_NOP|NCRCMD_DMA)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x00|0x80, 1920); sc->sc_lastcmd = 0x00|0x80; (
*(sc)->sc_glue->gl_write_reg)((sc), (0x03), (0x00|0x80)
); } while (0);
NCRCMD(sc, NCRCMD_TRANS|NCRCMD_DMA)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x10|0x80, 1921); sc->sc_lastcmd = 0x10|0x80; (
*(sc)->sc_glue->gl_write_reg)((sc), (0x03), (0x10|0x80)
); } while (0);
NCRDMA_GO(sc)(*(sc)->sc_glue->gl_dma_go)((sc));
}
1924}

1926/*
* This is the most critical part of the driver, and has to know
* how to deal with *all* error conditions and phases from the SCSI
* bus. If there are no errors and the DMA was active, then call the
* DMA pseudo-interrupt handler. If this returns 1, then that was it
* and we can return from here without further processing.
*
* Most of this needs verifying.
*/
1935int sdebug = 0;
1936int
1937ncr53c9x_intr(void *arg)
1938{
struct ncr53c9x_softc *sc = arg;
struct ncr53c9x_ecb *ecb;
struct scsi_link *sc_link;
struct ncr53c9x_tinfo *ti;
size_t size;
int nfifo;

NCR_TRACE(("[ncr53c9x_intr: state %d] ", sc->sc_state))do {if (ncr53c9x_debug & 0x10) printf ("[ncr53c9x_intr: state %d] "
, sc->sc_state);} while (0);
1
Assuming the condition is false→
2
←
Taking false branch→
3
←
Loop condition is false.  Exiting loop→

if (!NCRDMA_ISINTR(sc)(*(sc)->sc_glue->gl_dma_isintr)((sc)))
4
←
Assuming the condition is false→
5
←
Taking false branch→
return (0);

1951again:
/* and what do the registers say... */
ncr53c9x_readregs(sc);
6
←
Calling 'ncr53c9x_readregs'→
16
←
Returning from 'ncr53c9x_readregs'→

/*
* At the moment, only a SCSI Bus Reset or Illegal
* Command are classed as errors. A disconnect is a
* valid condition, and we let the code check is the
* "NCR_BUSFREE_OK" flag was set before declaring it
* and error.
*
* Also, the status register tells us about "Gross
* Errors" and "Parity errors". Only the Gross Error
* is really bad, and the parity errors are dealt
* with later
*
* TODO
*      If there are too many parity error, go to slow
*      cable mode ?
*/

/* SCSI Reset */
if (sc->sc_espintr & NCRINTR_SBR0x80) {
17
←
Assuming the condition is false→
18
←
Taking false branch→
if (NCR_READ_REG(sc, NCR_FFLAG)(*(sc)->sc_glue->gl_read_reg)((sc), (0x07)) & NCRFIFO_FF0x1f) {
	NCRCMD(sc, NCRCMD_FLUSH)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x01, 1975); sc->sc_lastcmd = 0x01; (*(sc)->
sc_glue->gl_write_reg)((sc), (0x03), (0x01)); } while (0);
	DELAY(1)(*delay_func)(1);
}
if (sc->sc_state != NCR_SBR9) {
	printf("%s: SCSI bus reset\n",
		sc->sc_dev.dv_xname);
	ncr53c9x_init(sc, 0); /* Restart everything */
	return (1);
}
1984#if 0
1985/*XXX*/		printf("<expected bus reset: "
	"[intr %x, stat %x, step %d]>\n",
	sc->sc_espintr, sc->sc_espstat,
	sc->sc_espstep);
1989#endif
if (sc->sc_nexus)
	panic("%s: nexus in reset state",
      sc->sc_dev.dv_xname);
goto sched;
}

ecb = sc->sc_nexus;
19
←
Value assigned to 'ecb'→

1998#define NCRINTR_ERR(0x80|0x40) (NCRINTR_SBR0x80|NCRINTR_ILL0x40)
if (sc->sc_espintr & NCRINTR_ERR(0x80|0x40) ||
20
←
Assuming the condition is false→
22
←
Taking false branch→
   sc->sc_espstat & NCRSTAT_GE0x40) {
21
←
Assuming the condition is false→

if (sc->sc_espstat & NCRSTAT_GE0x40) {
	/* Gross Error; no target ? */
	if (NCR_READ_REG(sc, NCR_FFLAG)(*(sc)->sc_glue->gl_read_reg)((sc), (0x07)) & NCRFIFO_FF0x1f) {
		NCRCMD(sc, NCRCMD_FLUSH)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x01, 2005); sc->sc_lastcmd = 0x01; (*(sc)->
sc_glue->gl_write_reg)((sc), (0x03), (0x01)); } while (0);
		DELAY(1)(*delay_func)(1);
	}
	if (sc->sc_state == NCR_CONNECTED5 ||
	    sc->sc_state == NCR_SELECTING2) {
		ecb->xs->error = XS_TIMEOUT4;
		ncr53c9x_done(sc, ecb);
	}
	return (1);
}

if (sc->sc_espintr & NCRINTR_ILL0x40) {
	if (sc->sc_flags & NCR_EXPECT_ILLCMD0x80) {
		/*
		 * Eat away "Illegal command" interrupt
		 * on a ESP100 caused by a re-selection
		 * while we were trying to select
		 * another target.
		 */
2024#ifdef DEBUG
		printf("%s: ESP100 work-around activated\n",
			sc->sc_dev.dv_xname);
2027#endif
		sc->sc_flags &= ~NCR_EXPECT_ILLCMD0x80;
		return (1);
	}
	/* illegal command, out of sync ? */
	printf("%s: illegal command: 0x%x "
	    "(state %d, phase %x, prevphase %x)\n",
		sc->sc_dev.dv_xname, sc->sc_lastcmd,
		sc->sc_state, sc->sc_phase,
		sc->sc_prevphase);
	if (NCR_READ_REG(sc, NCR_FFLAG)(*(sc)->sc_glue->gl_read_reg)((sc), (0x07)) & NCRFIFO_FF0x1f) {
		NCRCMD(sc, NCRCMD_FLUSH)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x01, 2038); sc->sc_lastcmd = 0x01; (*(sc)->
sc_glue->gl_write_reg)((sc), (0x03), (0x01)); } while (0);
		DELAY(1)(*delay_func)(1);
	}
	ncr53c9x_init(sc, 1); /* Restart everything */
	return (1);
}
}
sc->sc_flags &= ~NCR_EXPECT_ILLCMD0x80;

/*
* Call if DMA is active.
*
* If DMA_INTR returns true, then maybe go 'round the loop
* again in case there is no more DMA queued, but a phase
* change is expected.
*/
if (NCRDMA_ISACTIVE(sc)(*(sc)->sc_glue->gl_dma_isactive)((sc))) {
23
←
Assuming the condition is true→
24
←
Taking true branch→
int r = NCRDMA_INTR(sc)(*(sc)->sc_glue->gl_dma_intr)((sc));
if (r == -1) {
25
←
Assuming the condition is false→
26
←
Taking false branch→
	printf("%s: DMA error; resetting\n",
		sc->sc_dev.dv_xname);
	ncr53c9x_init(sc, 1);
	return (1);
}
/* If DMA active here, then go back to work... */
if (NCRDMA_ISACTIVE(sc)(*(sc)->sc_glue->gl_dma_isactive)((sc)))
27
←
Assuming the condition is false→
28
←
Taking false branch→
	return (1);

if ((sc->sc_espstat & NCRSTAT_TC0x10) == 0) {
29
←
Assuming the condition is true→
30
←
Taking true branch→
	/*
	 * DMA not completed.  If we can not find a
	 * acceptable explanation, print a diagnostic.
	 */
	if (sc->sc_state == NCR_SELECTING2)
31
←
Assuming field 'sc_state' is not equal to NCR_SELECTING→
32
←
Taking false branch→
		/*
		 * This can happen if we are reselected
		 * while using DMA to select a target.
		 */
		/*void*/;
	else if (sc->sc_prevphase == MESSAGE_OUT_PHASE(0x04|0x02)){
33
←
Assuming the condition is false→
34
←
Taking false branch→
		/*
		 * Our (multi-byte) message (eg SDTR)
		 * was interrupted by the target to
		 * send a MSG REJECT.
		 * Print diagnostic if current phase
		 * is not MESSAGE IN.
		 */
		if (sc->sc_phase != MESSAGE_IN_PHASE(0x04|0x02|0x01))
		    printf("%s: !TC on MSG OUT"
		       " [intr %x, stat %x, step %d]"
		       " prevphase %x, resid %lx\n",
			sc->sc_dev.dv_xname,
			sc->sc_espintr,
			sc->sc_espstat,
			sc->sc_espstep,
			sc->sc_prevphase,
			(u_long)sc->sc_omlen);
	} else if (sc->sc_dleft == 0) {
35
←
Assuming field 'sc_dleft' is equal to 0→
36
←
Taking true branch→
		/*
		 * The DMA operation was started for
		 * a DATA transfer. Print a diagnostic
		 * if the DMA counter and TC bit
		 * appear to be out of sync.
		 */
		printf("%s: !TC on DATA XFER"
		       " [intr %x, stat %x, step %d]"
		       " prevphase %x, resid %x\n",
			sc->sc_dev.dv_xname,
			sc->sc_espintr,
			sc->sc_espstat,
			sc->sc_espstep,
			sc->sc_prevphase,
			ecb?ecb->dleft:-1);
37
←
Assuming 'ecb' is null→
38
←
'?' condition is false→
	}
}
}

/*
* check for less serious errors
*/
if (sc->sc_espstat & NCRSTAT_PE0x20) {
39
←
Assuming the condition is false→
40
←
Taking false branch→
printf("%s: SCSI bus parity error\n", sc->sc_dev.dv_xname);
if (sc->sc_prevphase == MESSAGE_IN_PHASE(0x04|0x02|0x01))
	ncr53c9x_sched_msgout(SEND_PARITY_ERROR)do { do {if (ncr53c9x_debug & 0x08) printf ("ncr53c9x_sched_msgout %x %d "
, 0x0002, 2121);} while (0); do { if (ncr53c9x_debug & 0x100
) printf("<cmd:0x%x %d>", (unsigned)0x1a, 2121); sc->
sc_lastcmd = 0x1a; (*(sc)->sc_glue->gl_write_reg)((sc),
 (0x03), (0x1a)); } while (0); sc->sc_flags |= 0x40; sc->
sc_msgpriq |= (0x0002); } while (0);
else
	ncr53c9x_sched_msgout(SEND_INIT_DET_ERR)do { do {if (ncr53c9x_debug & 0x08) printf ("ncr53c9x_sched_msgout %x %d "
, 0x0004, 2123);} while (0); do { if (ncr53c9x_debug & 0x100
) printf("<cmd:0x%x %d>", (unsigned)0x1a, 2123); sc->
sc_lastcmd = 0x1a; (*(sc)->sc_glue->gl_write_reg)((sc),
 (0x03), (0x1a)); } while (0); sc->sc_flags |= 0x40; sc->
sc_msgpriq |= (0x0004); } while (0);
}

if (sc->sc_espintr & NCRINTR_DIS0x20) {
41
←
Assuming the condition is true→
42
←
Taking true branch→
sc->sc_msgify = 0;
NCR_MISC(("<DISC [intr %x, stat %x, step %d]>",do {if (ncr53c9x_debug & 0x08) printf ("<DISC [intr %x, stat %x, step %d]>"
, sc->sc_espintr,sc->sc_espstat,sc->sc_espstep);} while
 (0)
43
←
Assuming the condition is false→
44
←
Taking false branch→
45
←
Loop condition is false.  Exiting loop→
	sc->sc_espintr,sc->sc_espstat,sc->sc_espstep))do {if (ncr53c9x_debug & 0x08) printf ("<DISC [intr %x, stat %x, step %d]>"
, sc->sc_espintr,sc->sc_espstat,sc->sc_espstep);} while
 (0);
if (NCR_READ_REG(sc, NCR_FFLAG)(*(sc)->sc_glue->gl_read_reg)((sc), (0x07)) & NCRFIFO_FF0x1f) {
46
←
Assuming the condition is false→
47
←
Taking false branch→
	NCRCMD(sc, NCRCMD_FLUSH)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x01, 2131); sc->sc_lastcmd = 0x01; (*(sc)->
sc_glue->gl_write_reg)((sc), (0x03), (0x01)); } while (0);
2132/*			DELAY(1); */
}
/*
 * This command must (apparently) be issued within
 * 250mS of a disconnect. So here you are...
 */
NCRCMD(sc, NCRCMD_ENSEL)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x44, 2138); sc->sc_lastcmd = 0x44; (*(sc)->
sc_glue->gl_write_reg)((sc), (0x03), (0x44)); } while (0);
48
←
Assuming the condition is false→
49
←
Taking false branch→
50
←
Loop condition is false.  Exiting loop→

switch (sc->sc_state) {
51
←
Control jumps to 'case 2:'  at line 2144→
case NCR_RESELECTED3:
	goto sched;

case NCR_SELECTING2:
	ecb->xs->error = XS_SELTIMEOUT3;
52
←
Access to field 'xs' results in a dereference of a null pointer (loaded from variable 'ecb')
	goto finish;

case NCR_CONNECTED5:
	if ((sc->sc_flags & NCR_SYNCHNEGO0x08)) {
2150#ifdef NCR53C9X_DEBUG1
		if (ecb)
			sc_print_addr(ecb->xs->sc_link);
		printf("sync nego not completed!\n");
2154#endif
		ti = &sc->sc_tinfo[ecb->xs->sc_link->target];
		sc->sc_flags &= ~NCR_SYNCHNEGO0x08;
		ti->flags &= ~(T_NEGOTIATE0x02 | T_SYNCMODE0x08);
	}

	/* it may be OK to disconnect */
	if ((sc->sc_flags & NCR_ABORTING0x02) == 0) {
		/*
		 * Section 5.1.1 of the SCSI 2 spec
		 * suggests issuing a REQUEST SENSE
		 * following an unexpected disconnect.
		 * Some devices go into a contingent
		 * allegiance condition when
		 * disconnecting, and this is necessary
		 * to clean up their state.
		 */
		printf("%s: unexpected disconnect; ",
		    sc->sc_dev.dv_xname);
		if (ecb->flags & ECB_SENSE0x04) {
			printf("resetting\n");
			goto reset;
		}
		printf("sending REQUEST SENSE\n");
		timeout_del(&ecb->to);
		ncr53c9x_sense(sc, ecb);
		goto out;
	}

	ecb->xs->error = XS_TIMEOUT4;
	goto finish;

case NCR_DISCONNECT6:
	sc->sc_nexus = NULL((void *)0);
	goto sched;

case NCR_CMDCOMPLETE7:
	goto finish;
}
}

switch (sc->sc_state) {

case NCR_SBR9:
printf("%s: waiting for SCSI Bus Reset to happen\n",
	sc->sc_dev.dv_xname);
return (1);

case NCR_RESELECTED3:
/*
 * we must be continuing a message ?
 */
if (sc->sc_phase != MESSAGE_IN_PHASE(0x04|0x02|0x01)) {
	printf("%s: target didn't identify\n",
		sc->sc_dev.dv_xname);
	ncr53c9x_init(sc, 1);
	return (1);
}
2212printf("<<RESELECT CONT'd>>");
2213#if XXXX
ncr53c9x_msgin(sc);
if (sc->sc_state != NCR_CONNECTED5) {
	/* IDENTIFY fail?! */
	printf("%s: identify failed\n",
		sc->sc_dev.dv_xname);
	ncr53c9x_init(sc, 1);
	return (1);
}
2222#endif
break;

case NCR_IDENTIFIED4:
ecb = sc->sc_nexus;
if (sc->sc_phase != MESSAGE_IN_PHASE(0x04|0x02|0x01)) {
	int i = (NCR_READ_REG(sc, NCR_FFLAG)(*(sc)->sc_glue->gl_read_reg)((sc), (0x07))
	    & NCRFIFO_FF0x1f);
	/*
	 * Things are seriously fucked up.
	 * Pull the brakes, i.e. reset
	 */
	printf("%s: target didn't send tag: %d bytes in fifo\n",
	    sc->sc_dev.dv_xname, i);
	/* Drain and display fifo */
	while (i-- > 0)
		printf("[%d] ", NCR_READ_REG(sc, NCR_FIFO)(*(sc)->sc_glue->gl_read_reg)((sc), (0x02)));
	ncr53c9x_init(sc, 1);
	return (1);
} else
	goto msgin;

break;
case NCR_IDLE1:
case NCR_SELECTING2:
ecb = sc->sc_nexus;
if (sc->sc_espintr & NCRINTR_RESEL0x04) {
	sc->sc_msgpriq = sc->sc_msgout = sc->sc_msgoutq = 0;
	sc->sc_flags = 0;
	/*
	 * If we're trying to select a
	 * target ourselves, push our command
	 * back into the ready list.
	 */
	if (sc->sc_state == NCR_SELECTING2) {
		NCR_MISC(("backoff selector "))do {if (ncr53c9x_debug & 0x08) printf ("backoff selector "
);} while (0);
		timeout_del(&ecb->to);
		ncr53c9x_dequeue(sc, ecb);
		TAILQ_INSERT_HEAD(&sc->ready_list, ecb, chain)do { if (((ecb)->chain.tqe_next = (&sc->ready_list)
->tqh_first) != ((void *)0)) (&sc->ready_list)->
tqh_first->chain.tqe_prev = &(ecb)->chain.tqe_next;
 else (&sc->ready_list)->tqh_last = &(ecb)->
chain.tqe_next; (&sc->ready_list)->tqh_first = (ecb
); (ecb)->chain.tqe_prev = &(&sc->ready_list)->
tqh_first; } while (0);
		ecb->flags |= ECB_READY0x02;
		ecb = sc->sc_nexus = NULL((void *)0);
	}
	sc->sc_state = NCR_RESELECTED3;
	if (sc->sc_phase != MESSAGE_IN_PHASE(0x04|0x02|0x01)) {
		/*
		 * Things are seriously fucked up.
		 * Pull the brakes, i.e. reset
		 */
		printf("%s: target didn't identify\n",
			sc->sc_dev.dv_xname);
		ncr53c9x_init(sc, 1);
		return (1);
	}
	/*
	 * The C90 only inhibits FIFO writes until
	 * reselection is complete, instead of
	 * waiting until the interrupt status register
	 * has been read. So, if the reselect happens
	 * while we were entering a command bytes (for
	 * another target) some of those bytes can
	 * appear in the FIFO here, after the
	 * interrupt is taken.
	 */
	nfifo = ncr53c9x_rdfifo(sc, NCR_RDFIFO_START0);

	if (nfifo < 2 ||
	    (nfifo > 2 &&
	     sc->sc_rev != NCR_VARIANT_ESP1000)) {
		printf("%s: RESELECT: "
		    "%d bytes in FIFO! "
		    "[intr %x, stat %x, step %d, prevphase %x]\n",
			sc->sc_dev.dv_xname,
			nfifo,
			sc->sc_espintr,
			sc->sc_espstat,
			sc->sc_espstep,
			sc->sc_prevphase);
		ncr53c9x_init(sc, 1);
		return (1);
	}
	sc->sc_selid = sc->sc_imess[0];
	NCR_MISC(("selid=%2x ", sc->sc_selid))do {if (ncr53c9x_debug & 0x08) printf ("selid=%2x ", sc->
sc_selid);} while (0);

	/* Handle identify message */
	ncr53c9x_msgin(sc);
	if (nfifo != 2) {
		/*
		 * Note: this should not happen
		 * with `dmaselect' on.
		 */
		sc->sc_flags |= NCR_EXPECT_ILLCMD0x80;
		NCRCMD(sc, NCRCMD_FLUSH)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x01, 2313); sc->sc_lastcmd = 0x01; (*(sc)->
sc_glue->gl_write_reg)((sc), (0x03), (0x01)); } while (0);
	} else if (sc->sc_features & NCR_F_DMASELECT0x04 &&
		   sc->sc_rev == NCR_VARIANT_ESP1000) {
		sc->sc_flags |= NCR_EXPECT_ILLCMD0x80;
	}

	if (sc->sc_state != NCR_CONNECTED5 &&
	    sc->sc_state != NCR_IDENTIFIED4) {
		/* IDENTIFY fail?! */
		printf("%s: identify failed, state %d, intr %02x\n",
			sc->sc_dev.dv_xname, sc->sc_state,
		    sc->sc_espintr);
		ncr53c9x_init(sc, 1);
		return (1);
	}
	goto shortcut; /* ie. next phase expected soon */
}

2331#define	NCRINTR_DONE(0x08|0x10)	(NCRINTR_FC0x08|NCRINTR_BS0x10)
if ((sc->sc_espintr & NCRINTR_DONE(0x08|0x10)) == NCRINTR_DONE(0x08|0x10)) {
	/*
	 * Arbitration won; examine the `step' register
	 * to determine how far the selection could progress.
	 */
	ecb = sc->sc_nexus;
	if (!ecb)
		panic("ncr53c9x: no nexus");

	sc_link = ecb->xs->sc_link;
	ti = &sc->sc_tinfo[sc_link->target];

	switch (sc->sc_espstep) {
	case 0:
		/*
		 * The target did not respond with a
		 * message out phase - probably an old
		 * device that doesn't recognize ATN.
		 * Clear ATN and just continue, the
		 * target should be in the command
		 * phase.
		 * XXXX check for command phase?
		 */
		NCRCMD(sc, NCRCMD_RSTATN)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x1b, 2355); sc->sc_lastcmd = 0x1b; (*(sc)->
sc_glue->gl_write_reg)((sc), (0x03), (0x1b)); } while (0);
		break;
	case 1:
		if ((ti->flags & T_NEGOTIATE0x02) == 0 &&
		    ecb->tag[0] == 0) {
			printf("%s: step 1 & !NEG\n",
				sc->sc_dev.dv_xname);
			goto reset;
		}
		if (sc->sc_phase != MESSAGE_OUT_PHASE(0x04|0x02)) {
			printf("%s: !MSGOUT\n",
				sc->sc_dev.dv_xname);
			goto reset;
		}
		if (ti->flags & T_WIDE0x80) {
			ncr53c9x_sched_msgout(SEND_WDTR)do { do {if (ncr53c9x_debug & 0x08) printf ("ncr53c9x_sched_msgout %x %d "
, 0x0040, 2370);} while (0); do { if (ncr53c9x_debug & 0x100
) printf("<cmd:0x%x %d>", (unsigned)0x1a, 2370); sc->
sc_lastcmd = 0x1a; (*(sc)->sc_glue->gl_write_reg)((sc),
 (0x03), (0x1a)); } while (0); sc->sc_flags |= 0x40; sc->
sc_msgpriq |= (0x0040); } while (0);
		}
		if (ti->flags & T_NEGOTIATE0x02) {
			/* Start negotiating */
			ti->period = sc->sc_minsync;
			ti->offset = 15;
			sc->sc_flags |= NCR_SYNCHNEGO0x08;
			if (ecb->tag[0])
				ncr53c9x_sched_msgout(SEND_TAG|SEND_SDTR)do { do {if (ncr53c9x_debug & 0x08) printf ("ncr53c9x_sched_msgout %x %d "
, 0x0100|0x0080, 2378);} while (0); do { if (ncr53c9x_debug &
 0x100) printf("<cmd:0x%x %d>", (unsigned)0x1a, 2378); sc
->sc_lastcmd = 0x1a; (*(sc)->sc_glue->gl_write_reg)(
(sc), (0x03), (0x1a)); } while (0); sc->sc_flags |= 0x40; sc
->sc_msgpriq |= (0x0100|0x0080); } while (0);
			else
				ncr53c9x_sched_msgout(SEND_SDTR)do { do {if (ncr53c9x_debug & 0x08) printf ("ncr53c9x_sched_msgout %x %d "
, 0x0080, 2380);} while (0); do { if (ncr53c9x_debug & 0x100
) printf("<cmd:0x%x %d>", (unsigned)0x1a, 2380); sc->
sc_lastcmd = 0x1a; (*(sc)->sc_glue->gl_write_reg)((sc),
 (0x03), (0x1a)); } while (0); sc->sc_flags |= 0x40; sc->
sc_msgpriq |= (0x0080); } while (0);
		} else {
			/* Could not do ATN3 so send TAG */
			ncr53c9x_sched_msgout(SEND_TAG)do { do {if (ncr53c9x_debug & 0x08) printf ("ncr53c9x_sched_msgout %x %d "
, 0x0100, 2383);} while (0); do { if (ncr53c9x_debug & 0x100
) printf("<cmd:0x%x %d>", (unsigned)0x1a, 2383); sc->
sc_lastcmd = 0x1a; (*(sc)->sc_glue->gl_write_reg)((sc),
 (0x03), (0x1a)); } while (0); sc->sc_flags |= 0x40; sc->
sc_msgpriq |= (0x0100); } while (0);
		}
		sc->sc_prevphase = MESSAGE_OUT_PHASE(0x04|0x02); /* XXXX */
		break;
	case 3:
		/*
		 * Grr, this is supposed to mean
		 * "target left command phase  prematurely".
		 * It seems to happen regularly when
		 * sync mode is on.
		 * Look at FIFO to see if command went out.
		 * (Timing problems?)
		 */
		if (sc->sc_features & NCR_F_DMASELECT0x04) {
			if (sc->sc_cmdlen == 0)
				/* Hope for the best.. */
				break;
		} else if ((NCR_READ_REG(sc, NCR_FFLAG)(*(sc)->sc_glue->gl_read_reg)((sc), (0x07))
			    & NCRFIFO_FF0x1f) == 0) {
			/* Hope for the best.. */
			break;
		}
		printf("(%s:%d:%d): selection failed;"
			" %d left in FIFO "
			"[intr %x, stat %x, step %d]\n",
			sc->sc_dev.dv_xname,
			sc_link->target,
			sc_link->lun,
			NCR_READ_REG(sc, NCR_FFLAG)(*(sc)->sc_glue->gl_read_reg)((sc), (0x07))
			 & NCRFIFO_FF0x1f,
			sc->sc_espintr, sc->sc_espstat,
			sc->sc_espstep);
		NCRCMD(sc, NCRCMD_FLUSH)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x01, 2415); sc->sc_lastcmd = 0x01; (*(sc)->
sc_glue->gl_write_reg)((sc), (0x03), (0x01)); } while (0);
		ncr53c9x_sched_msgout(SEND_ABORT)do { do {if (ncr53c9x_debug & 0x08) printf ("ncr53c9x_sched_msgout %x %d "
, 0x0020, 2416);} while (0); do { if (ncr53c9x_debug & 0x100
) printf("<cmd:0x%x %d>", (unsigned)0x1a, 2416); sc->
sc_lastcmd = 0x1a; (*(sc)->sc_glue->gl_write_reg)((sc),
 (0x03), (0x1a)); } while (0); sc->sc_flags |= 0x40; sc->
sc_msgpriq |= (0x0020); } while (0);
		return (1);
	case 2:
		/* Select stuck at Command Phase */
		NCRCMD(sc, NCRCMD_FLUSH)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x01, 2420); sc->sc_lastcmd = 0x01; (*(sc)->
sc_glue->gl_write_reg)((sc), (0x03), (0x01)); } while (0);
		break;
	case 4:
		if (sc->sc_features & NCR_F_DMASELECT0x04 &&
		    sc->sc_cmdlen != 0)
			printf("(%s:%d:%d): select; "
			       "%lu left in DMA buffer "
			"[intr %x, stat %x, step %d]\n",
				sc->sc_dev.dv_xname,
				sc_link->target,
				sc_link->lun,
				(u_long)sc->sc_cmdlen,
				sc->sc_espintr,
				sc->sc_espstat,
				sc->sc_espstep);
		/* So far, everything went fine */
		break;
	}

	sc->sc_prevphase = INVALID_PHASE0x101; /* ?? */
	/* Do an implicit RESTORE POINTERS. */
	sc->sc_dp = ecb->daddr;
	sc->sc_dleft = ecb->dleft;
	sc->sc_state = NCR_CONNECTED5;
	break;

} else {

	printf("%s: unexpected status after select"
		": [intr %x, stat %x, step %x]\n",
		sc->sc_dev.dv_xname,
		sc->sc_espintr, sc->sc_espstat,
		sc->sc_espstep);
	NCRCMD(sc, NCRCMD_FLUSH)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x01, 2453); sc->sc_lastcmd = 0x01; (*(sc)->
sc_glue->gl_write_reg)((sc), (0x03), (0x01)); } while (0);
	DELAY(1)(*delay_func)(1);
	goto reset;
}
if (sc->sc_state == NCR_IDLE1) {
	printf("%s: stray interrupt\n",
	    sc->sc_dev.dv_xname);
		return (0);
}
break;

case NCR_CONNECTED5:
if (sc->sc_flags & NCR_ICCS0x10) {
	/* "Initiate Command Complete Steps" in progress */
	u_char msg;

	sc->sc_flags &= ~NCR_ICCS0x10;

	if (!(sc->sc_espintr & NCRINTR_DONE(0x08|0x10))) {
		printf("%s: ICCS: "
		      ": [intr %x, stat %x, step %x]\n",
			sc->sc_dev.dv_xname,
			sc->sc_espintr, sc->sc_espstat,
			sc->sc_espstep);
	}
	ncr53c9x_rdfifo(sc, NCR_RDFIFO_START0);
	if (sc->sc_imlen < 2)
		printf("%s: can't get status, only %d bytes\n",
		    sc->sc_dev.dv_xname, (int)sc->sc_imlen);
	ecb->stat = sc->sc_imess[sc->sc_imlen - 2];
	msg = sc->sc_imess[sc->sc_imlen - 1];
	NCR_PHASE(("<stat:(%x,%x)>", ecb->stat, msg))do {if (ncr53c9x_debug & 0x40) printf ("<stat:(%x,%x)>"
, ecb->stat, msg);}while (0);
	if (msg == MSG_CMDCOMPLETE0x00) {
		ecb->dleft = (ecb->flags & ECB_TENTATIVE_DONE0x100)
			? 0
			: sc->sc_dleft;
		if ((ecb->flags & ECB_SENSE0x04) == 0)
			ecb->xs->resid = ecb->dleft;
		sc->sc_state = NCR_CMDCOMPLETE7;
	} else
		printf("%s: STATUS_PHASE: msg %d\n",
			sc->sc_dev.dv_xname, msg);
	sc->sc_imlen = 0;
	NCRCMD(sc, NCRCMD_MSGOK)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x12, 2496); sc->sc_lastcmd = 0x12; (*(sc)->
sc_glue->gl_write_reg)((sc), (0x03), (0x12)); } while (0);
	goto shortcut; /* ie. wait for disconnect */
}
break;
default:
/* Don't panic: reset. */
printf("%s: invalid state: %d\n",
      sc->sc_dev.dv_xname,
      sc->sc_state);
ncr53c9x_scsi_reset(sc);
goto out;
break;
}

/*
* Driver is now in state NCR_CONNECTED, i.e. we
* have a current command working the SCSI bus.
*/
if (sc->sc_state != NCR_CONNECTED5 || ecb == NULL((void *)0)) {
panic("ncr53c9x no nexus");
}

switch (sc->sc_phase) {
case MESSAGE_OUT_PHASE(0x04|0x02):
NCR_PHASE(("MESSAGE_OUT_PHASE "))do {if (ncr53c9x_debug & 0x40) printf ("MESSAGE_OUT_PHASE "
);}while (0);
ncr53c9x_msgout(sc);
sc->sc_prevphase = MESSAGE_OUT_PHASE(0x04|0x02);
break;
case MESSAGE_IN_PHASE(0x04|0x02|0x01):
2525msgin:
NCR_PHASE(("MESSAGE_IN_PHASE "))do {if (ncr53c9x_debug & 0x40) printf ("MESSAGE_IN_PHASE "
);}while (0);
if (sc->sc_espintr & NCRINTR_BS0x10) {
	if ((sc->sc_rev != NCR_VARIANT_FAS3669) ||
	    !(sc->sc_espstat2 & FAS_STAT2_EMPTY0x80)) {
		NCRCMD(sc, NCRCMD_FLUSH)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x01, 2530); sc->sc_lastcmd = 0x01; (*(sc)->
sc_glue->gl_write_reg)((sc), (0x03), (0x01)); } while (0);
	}
	sc->sc_flags |= NCR_WAITI0x20;
	NCRCMD(sc, NCRCMD_TRANS)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x10, 2533); sc->sc_lastcmd = 0x10; (*(sc)->
sc_glue->gl_write_reg)((sc), (0x03), (0x10)); } while (0);
} else if (sc->sc_espintr & NCRINTR_FC0x08) {
	if ((sc->sc_flags & NCR_WAITI0x20) == 0) {
		printf("%s: MSGIN: unexpected FC bit: "
			"[intr %x, stat %x, step %x]\n",
		sc->sc_dev.dv_xname,
		sc->sc_espintr, sc->sc_espstat,
		sc->sc_espstep);
	}
	sc->sc_flags &= ~NCR_WAITI0x20;
	ncr53c9x_rdfifo(sc,
	    (sc->sc_prevphase == sc->sc_phase) ?
	    NCR_RDFIFO_CONTINUE1 : NCR_RDFIFO_START0);
	ncr53c9x_msgin(sc);
} else {
	printf("%s: MSGIN: weird bits: "
		"[intr %x, stat %x, step %x]\n",
		sc->sc_dev.dv_xname,
		sc->sc_espintr, sc->sc_espstat,
		sc->sc_espstep);
}
sc->sc_prevphase = MESSAGE_IN_PHASE(0x04|0x02|0x01);
goto shortcut;	/* i.e. expect data to be ready */
break;
case COMMAND_PHASE(0x02):
/*
 * Send the command block. Normally we don't see this
 * phase because the SEL_ATN command takes care of
 * all this. However, we end up here if either the
 * target or we wanted to exchange some more messages
 * first (e.g. to start negotiations).
 */

NCR_PHASE(("COMMAND_PHASE 0x%02x (%d) ",do {if (ncr53c9x_debug & 0x40) printf ("COMMAND_PHASE 0x%02x (%d) "
, ecb->cmd.cmd.opcode, ecb->clen);}while (0)
	ecb->cmd.cmd.opcode, ecb->clen))do {if (ncr53c9x_debug & 0x40) printf ("COMMAND_PHASE 0x%02x (%d) "
, ecb->cmd.cmd.opcode, ecb->clen);}while (0);
if (NCR_READ_REG(sc, NCR_FFLAG)(*(sc)->sc_glue->gl_read_reg)((sc), (0x07)) & NCRFIFO_FF0x1f) {
	NCRCMD(sc, NCRCMD_FLUSH)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x01, 2569); sc->sc_lastcmd = 0x01; (*(sc)->
sc_glue->gl_write_reg)((sc), (0x03), (0x01)); } while (0);
2570/*			DELAY(1); */
}
if (sc->sc_features & NCR_F_DMASELECT0x04) {
	/* setup DMA transfer for command */
	size = ecb->clen;
	sc->sc_cmdlen = size;
	sc->sc_cmdp = (caddr_t)&ecb->cmd.cmd;
	NCRDMA_SETUP(sc, &sc->sc_cmdp, &sc->sc_cmdlen,(*(sc)->sc_glue->gl_dma_setup)((sc), (&sc->sc_cmdp
), (&sc->sc_cmdlen), (0), (&size))
		     0, &size)(*(sc)->sc_glue->gl_dma_setup)((sc), (&sc->sc_cmdp
), (&sc->sc_cmdlen), (0), (&size));
	/* Program the SCSI counter */
	NCR_SET_COUNT(sc, size)do { (*((sc))->sc_glue->gl_write_reg)(((sc)), (0x00), (
(size))); (*((sc))->sc_glue->gl_write_reg)(((sc)), (0x01
), ((size) >> 8)); if ((sc->sc_cfg2 & 0x40) || (
sc->sc_rev == 9)) { (*((sc))->sc_glue->gl_write_reg)
(((sc)), (0x0e), ((size) >> 16)); } if (sc->sc_rev ==
 9) { (*(sc)->sc_glue->gl_write_reg)((sc), (0xf), (0));
 } } while (0);

	/* load the count in */
	NCRCMD(sc, NCRCMD_NOP|NCRCMD_DMA)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x00|0x80, 2583); sc->sc_lastcmd = 0x00|0x80; (
*(sc)->sc_glue->gl_write_reg)((sc), (0x03), (0x00|0x80)
); } while (0);

	/* start the command transfer */
	NCRCMD(sc, NCRCMD_TRANS | NCRCMD_DMA)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x10 | 0x80, 2586); sc->sc_lastcmd = 0x10 | 0x80
; (*(sc)->sc_glue->gl_write_reg)((sc), (0x03), (0x10 | 0x80
)); } while (0);
	NCRDMA_GO(sc)(*(sc)->sc_glue->gl_dma_go)((sc));
} else {
	ncr53c9x_wrfifo(sc, (u_char *)&ecb->cmd.cmd, ecb->clen);
	sc->sc_cmdlen = 0;
	NCRCMD(sc, NCRCMD_TRANS)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x10, 2591); sc->sc_lastcmd = 0x10; (*(sc)->
sc_glue->gl_write_reg)((sc), (0x03), (0x10)); } while (0);
}
sc->sc_prevphase = COMMAND_PHASE(0x02);
break;
case DATA_OUT_PHASE(0):
NCR_PHASE(("DATA_OUT_PHASE [%ld] ",(long)sc->sc_dleft))do {if (ncr53c9x_debug & 0x40) printf ("DATA_OUT_PHASE [%ld] "
,(long)sc->sc_dleft);}while (0);
NCRCMD(sc, NCRCMD_FLUSH)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x01, 2597); sc->sc_lastcmd = 0x01; (*(sc)->
sc_glue->gl_write_reg)((sc), (0x03), (0x01)); } while (0);
size = min(sc->sc_dleft, sc->sc_maxxfer);
NCRDMA_SETUP(sc, &sc->sc_dp, &sc->sc_dleft,(*(sc)->sc_glue->gl_dma_setup)((sc), (&sc->sc_dp
), (&sc->sc_dleft), (0), (&size))
	  0, &size)(*(sc)->sc_glue->gl_dma_setup)((sc), (&sc->sc_dp
), (&sc->sc_dleft), (0), (&size));
sc->sc_prevphase = DATA_OUT_PHASE(0);
goto setup_xfer;
case DATA_IN_PHASE(0x01):
NCR_PHASE(("DATA_IN_PHASE "))do {if (ncr53c9x_debug & 0x40) printf ("DATA_IN_PHASE ");
}while (0);
if (sc->sc_rev == NCR_VARIANT_ESP1000)
	NCRCMD(sc, NCRCMD_FLUSH)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x01, 2606); sc->sc_lastcmd = 0x01; (*(sc)->
sc_glue->gl_write_reg)((sc), (0x03), (0x01)); } while (0);
size = min(sc->sc_dleft, sc->sc_maxxfer);
NCRDMA_SETUP(sc, &sc->sc_dp, &sc->sc_dleft,(*(sc)->sc_glue->gl_dma_setup)((sc), (&sc->sc_dp
), (&sc->sc_dleft), (1), (&size))
	  1, &size)(*(sc)->sc_glue->gl_dma_setup)((sc), (&sc->sc_dp
), (&sc->sc_dleft), (1), (&size));
sc->sc_prevphase = DATA_IN_PHASE(0x01);
setup_xfer:
/* Target returned to data phase: wipe "done" memory */
ecb->flags &= ~ECB_TENTATIVE_DONE0x100;

/* Program the SCSI counter */
NCR_SET_COUNT(sc, size)do { (*((sc))->sc_glue->gl_write_reg)(((sc)), (0x00), (
(size))); (*((sc))->sc_glue->gl_write_reg)(((sc)), (0x01
), ((size) >> 8)); if ((sc->sc_cfg2 & 0x40) || (
sc->sc_rev == 9)) { (*((sc))->sc_glue->gl_write_reg)
(((sc)), (0x0e), ((size) >> 16)); } if (sc->sc_rev ==
 9) { (*(sc)->sc_glue->gl_write_reg)((sc), (0xf), (0));
 } } while (0);

/* load the count in */
NCRCMD(sc, NCRCMD_NOP|NCRCMD_DMA)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x00|0x80, 2619); sc->sc_lastcmd = 0x00|0x80; (
*(sc)->sc_glue->gl_write_reg)((sc), (0x03), (0x00|0x80)
); } while (0);

/*
 * Note that if `size' is 0, we've already transceived
 * all the bytes we want but we're still in DATA PHASE.
 * Apparently, the device needs padding. Also, a
 * transfer size of 0 means "maximum" to the chip
 * DMA logic.
 */
NCRCMD(sc,do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)(size==0?0x18:0x10)|0x80, 2629); sc->sc_lastcmd
 = (size==0?0x18:0x10)|0x80; (*(sc)->sc_glue->gl_write_reg
)((sc), (0x03), ((size==0?0x18:0x10)|0x80)); } while (0)
       (size==0?NCRCMD_TRPAD:NCRCMD_TRANS)|NCRCMD_DMA)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)(size==0?0x18:0x10)|0x80, 2629); sc->sc_lastcmd
 = (size==0?0x18:0x10)|0x80; (*(sc)->sc_glue->gl_write_reg
)((sc), (0x03), ((size==0?0x18:0x10)|0x80)); } while (0);
NCRDMA_GO(sc)(*(sc)->sc_glue->gl_dma_go)((sc));
return (1);
case STATUS_PHASE(0x02|0x01):
NCR_PHASE(("STATUS_PHASE "))do {if (ncr53c9x_debug & 0x40) printf ("STATUS_PHASE ");}
while (0);
sc->sc_flags |= NCR_ICCS0x10;
NCRCMD(sc, NCRCMD_ICCS)do { if (ncr53c9x_debug & 0x100) printf("<cmd:0x%x %d>"
, (unsigned)0x11, 2635); sc->sc_lastcmd = 0x11; (*(sc)->
sc_glue->gl_write_reg)((sc), (0x03), (0x11)); } while (0);
sc->sc_prevphase = STATUS_PHASE(0x02|0x01);
goto shortcut;	/* i.e. expect status results soon */
break;
case INVALID_PHASE0x101:
break;
default:
printf("%s: unexpected bus phase; resetting\n",
    sc->sc_dev.dv_xname);
goto reset;
}

2647out:
return (1);

2650reset:
ncr53c9x_init(sc, 1);
goto out;

2654finish:
ncr53c9x_done(sc, ecb);
goto out;

2658sched:
sc->sc_state = NCR_IDLE1;
ncr53c9x_sched(sc);
goto out;

2663shortcut:
/*
* The idea is that many of the SCSI operations take very little
* time, and going away and getting interrupted is too high an
* overhead to pay. For example, selecting, sending a message
* and command and then doing some work can be done in one "pass".
*
* The delay is a heuristic. It is 2 when at 20MHz, 2 at 25MHz and 1
* at 40MHz. This needs testing.
*/
{
struct timeval wait, cur;

microuptime(&wait);
wait.tv_usec += 50/sc->sc_freq;
if (wait.tv_usec >= 1000000) {
	wait.tv_sec++;
	wait.tv_usec -= 1000000;
}
do {
	if (NCRDMA_ISINTR(sc)(*(sc)->sc_glue->gl_dma_isintr)((sc)))
		goto again;
	microuptime(&cur);
} while (timercmp(&cur, &wait, <=)(((&cur)->tv_sec == (&wait)->tv_sec) ? ((&cur
)->tv_usec <= (&wait)->tv_usec) : ((&cur)->
tv_sec <= (&wait)->tv_sec)));
}
goto out;
2689}

2691void
2692ncr53c9x_abort(struct ncr53c9x_softc *sc, struct ncr53c9x_ecb *ecb)
2693{

/* 2 secs for the abort */
ecb->timeout = NCR_ABORT_TIMEOUT2000;
ecb->flags |= ECB_ABORT0x40;

if (ecb == sc->sc_nexus) {
int timeout = ecb->timeout;

/*
 * If we're still selecting, the message will be scheduled
 * after selection is complete.
 */
if (sc->sc_state == NCR_CONNECTED5)
	ncr53c9x_sched_msgout(SEND_ABORT)do { do {if (ncr53c9x_debug & 0x08) printf ("ncr53c9x_sched_msgout %x %d "
, 0x0020, 2707);} while (0); do { if (ncr53c9x_debug & 0x100
) printf("<cmd:0x%x %d>", (unsigned)0x1a, 2707); sc->
sc_lastcmd = 0x1a; (*(sc)->sc_glue->gl_write_reg)((sc),
 (0x03), (0x1a)); } while (0); sc->sc_flags |= 0x40; sc->
sc_msgpriq |= (0x0020); } while (0);

/*
 * Reschedule timeout.
 */
if (timeout > 1000000)
	timeout = (timeout / 1000) * hz;
else
	timeout = (timeout * hz) / 1000;
timeout_add(&ecb->to, timeout);
} else {
/*
 * Just leave the command where it is.
 * XXX - what choice do we have but to reset the SCSI
 *	 eventually?
 */
if (sc->sc_state == NCR_IDLE1)
	ncr53c9x_sched(sc);
}
2726}

2728void
2729ncr53c9x_timeout(void *arg)
2730{
struct ncr53c9x_ecb *ecb = arg;
struct scsi_xfer *xs = ecb->xs;
struct scsi_link *sc_link = xs->sc_link;
struct ncr53c9x_softc *sc = sc_link->bus->sb_adapter_softc;
struct ncr53c9x_tinfo *ti = &sc->sc_tinfo[sc_link->target];
int s;

sc_print_addr(sc_link);
printf("timed out [ecb %p (flags 0x%x, dleft %x, stat %x)], "
      "<state %d, nexus %p, phase(l %x, c %x, p %x), resid %lx, "
      "msg(q %x,o %x) %s>",
ecb, ecb->flags, ecb->dleft, ecb->stat,
sc->sc_state, sc->sc_nexus,
NCR_READ_REG(sc, NCR_STAT)(*(sc)->sc_glue->gl_read_reg)((sc), (0x04)),
sc->sc_phase, sc->sc_prevphase,
(long)sc->sc_dleft, sc->sc_msgpriq, sc->sc_msgout,
NCRDMA_ISACTIVE(sc)(*(sc)->sc_glue->gl_dma_isactive)((sc)) ? "DMA active" : "");
2748#if NCR53C9X_DEBUG1 > 1
printf("TRACE: %s.", ecb->trace);
2750#endif

s = splbio()splraise(0x3);

if (ecb->flags & ECB_ABORT0x40) {
/* abort timed out */
printf(" AGAIN\n");

ncr53c9x_init(sc, 1);
} else {
/* abort the operation that has timed out */
printf("\n");
xs->error = XS_TIMEOUT4;
ncr53c9x_abort(sc, ecb);

/* Disable sync mode if stuck in a data phase */
if (ecb == sc->sc_nexus &&
    (ti->flags & T_SYNCMODE0x08) != 0 &&
    (sc->sc_phase & (MSGI0x04|CDI0x02)) == 0) {
	sc_print_addr(sc_link);
	printf("sync negotiation disabled\n");
	sc->sc_cfflags |= (1 << (sc_link->target + 16));
}
}

splx(s)spllower(s);
2776}